> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trylath.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Every Lath operation is POST https://platform.trylath.com/<operation name with dots replaced by slashes>, with a JSON body and `Authorization: Bearer <key>`. `email.send` is POST /email/send.
> Branch on `error.code`, never on `error.message`. Every refusal also carries `error.fix`, which names the next step.
> Send an `Idempotency-Key` header on any operation that is not retry-safe, so a retry cannot run it twice.
> A `lath_test_` key emails only the account's own members and sends no SMS; a `lath_live_` key reaches real recipients and is billed.
> The OpenAPI document, generated from the same registry as the routes, is at https://platform.trylath.com/openapi.json.

# Sign-in methods

> A code, a link, a text, a password, a passkey, or Google, Microsoft and GitHub. Four shapes of call, and one settings document that decides which of them your users are offered.

## Codes and links

`auth.signin.start` takes `email_code`, `email_link` or `sms_code` and returns a `challengeId`; `auth.signin.verify` takes that and the secret the person received.

A code is six digits, lives ten minutes and allows five attempts. A link lives fifteen minutes. `email_link` also needs a `redirectTo` on an allowed redirect origin, because the link has to land somewhere.

All three are on by default. Nothing about the answer reveals whether the address already has an account.

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST https://platform.trylath.com/auth/signin/start \
    -H "Authorization: Bearer lath_pk_..." \
    -H "Content-Type: application/json" \
    -d '{"method":"email_code","identifier":"you@example.com"}'
  ```

  ```ts TypeScript theme={null}
  import { createLath } from "@trylath/sdk";

  const lath = createLath({ key: process.env.LATH_PUBLISHABLE_KEY });

  const { result } = await lath.auth.signin.start({ method: "email_code", identifier: "you@example.com" });
  ```

  ```bash CLI theme={null}
  lath auth signin start --method email_code --identifier you@example.com
  ```
</CodeGroup>

## Passwords, which are off until you ask

`password` is the one method that starts switched off. Turn it on with `auth.settings.set`, then `auth.password.set` gives a user one and `auth.password.signin` uses it.

The rules are the environment's: at least twelve characters by default, and a breach check that asks a k-anonymity range service and fails closed when it cannot reach it. `auth.password.remove` takes a password off an account without touching the account.

## Passkeys

`auth.passkey.register.start` and `auth.passkey.register.verify` add one; `auth.passkey.signin.start` and `auth.passkey.signin.verify` use it. `auth.passkey.list` and `auth.passkey.remove` are the user's own management.

A passkey binds to an origin, so this method is unavailable until the environment has one: either a relying party id, or at least one allowed redirect origin to derive it from. Change the relying party id later and every passkey already registered under the old one stops working.

## Google, Microsoft and GitHub

`auth.oauth.start` returns where to send the person; `auth.oauth.complete` turns what comes back into a session.

All three work through Lath's own registered app, which means the consent screen says Lath. `auth.oauth.app.set` replaces that with your own client id and secret so it says your name instead; `auth.oauth.app.list` shows which is in use, and `auth.oauth.app.remove` goes back to the shared one.

## Enabled is not the same as offered

`auth.settings.get` reports three things per method: whether it is enabled, whether it is available, and whether it is therefore offered — plus the reason when it is not. A method can be switched on and still not work: `sms_code` needs a carrier registration that is active and a phone number to send from, and a social provider needs an app registered for it.

Leaving one enabled while it is unavailable is fine. It starts being offered the moment what it needs is in place, and until then the hosted sign-in page does not show it.

Calling a method that is switched off is refused with `method_disabled`. Starting too many sign-ins is refused with `rate_limited`: five per address and thirty per IP address in ten minutes, and thirty completions per IP address in the same window.