Auth

Email+password sessions for outside users. Signup/login mint a short-lived session credential and return the same <prefix>.<suffix> bearer API keys use; logout revokes it.

postEmail+password signup; mints a session credential.

Creates an account with entitlement mask 7 (no APITrading), stores the password (argon2id), and mints a session credential. `session_token` is a standard `<prefix>.<suffix>` bearer, returned exactly once, expiring after 7 days.

postEmail+password login; mints a session credential.

Verifies the password and mints a fresh 7-day session credential. Failed logins are uniformly `401 unauthorized` whether the email is unknown or the password wrong (equalized timing) — the endpoint is not an account-existence oracle.

postRevoke the current session credential.

Revokes the session credential authenticating this request; takes effect immediately. Only session credentials may call logout — an API key gets `400 invalid_request` (revoke keys via `DELETE /v1/credentials/{credential_id}`).

postConsume an e-mail confirmation link.

Marks the account e-mail verified. Single-use, 24 h expiry; a newer link supersedes older ones. `400 token_invalid` covers every failure (unknown / expired / used / wrong purpose) — the endpoint is not a token oracle. No session is minted.

postRe-send the e-mail confirmation link.

Issues a fresh confirmation link (superseding older ones) and e-mails it to the account address. No-op (`delivery: not_needed`) when already verified.

postRequest a password-reset link.

Always `202` — the response is identical whether the address exists or not (no account enumeration); when it does, a 30-minute single-use reset link is sent asynchronously.

postConsume a reset link and set a new password.

Sets the password, revokes all existing sessions (API keys untouched), marks the e-mail verified, and mints a fresh 7-day session. Password is validated before the single-use token is consumed.

postChange the password of the signed-in account.

Requires the current password; revokes every other session on the account (the caller keeps theirs). Session credentials only.