Sign in your first user

Send the code

auth.signin.start takes a method and an identifier and returns a challengeId. The methods are email_code, email_link and sms_code.It never reveals whether the address is already a user. That is deliberate: an endpoint that answers differently for a known address is an account-enumeration oracle, and this one cannot be used as one.Its permission is auth:public, so your frontend can call it with a publishable key. No secret key in a browser.

curl -X POST https://platform.trylath.com/auth/signin/start \
  -H "Authorization: Bearer lath_pk_..." \
  -H "Content-Type: application/json" \
  -d '{"method":"email_code","identifier":"you@example.com"}'

import { createLath } from "@trylath/sdk";

const lath = createLath({ key: process.env.LATH_PUBLISHABLE_KEY });

const { result } = await lath.auth.signin.start({ method: "email_code", identifier: "you@example.com" });

lath auth signin start --method email_code --identifier you@example.com

Exchange it for a session

auth.signin.verify takes the challengeId and the six digits. On a first sign-in it creates the user and a verified identity, then issues a session: a short-lived access token and a rotating refresh token.There is no separate sign-up call, and that is the point — an account is a side effect of proving an address, so there is no window in which a user exists with an address nobody has proved.

curl -X POST https://platform.trylath.com/auth/signin/verify \
  -H "Authorization: Bearer lath_pk_..." \
  -H "Content-Type: application/json" \
  -d '{"challengeId":"...","secret":"123456"}'

import { createLath } from "@trylath/sdk";

const lath = createLath({ key: process.env.LATH_PUBLISHABLE_KEY });

const { result } = await lath.auth.signin.verify({ challengeId: "...", secret: "123456" });

lath auth signin verify --challengeId ... --secret 123456

Handle the second factor

When the user has a second factor, or the environment requires one, verify returns mfa.mfaToken instead of a session. Read for the session before assuming you have one — a client that reads session.accessToken unconditionally crashes on exactly the accounts that took security seriously.Finish with auth.mfa.verify, which takes the token and the digits from the authenticator app, or a recovery code.

Check the token on your own API

verifyAccessToken in @trylath/sdk validates a token against your environment’s published keys, so your backend does not call Lath on every request. requireUser does it for a standard Request.See the SDK guide for the framework-shaped versions.

import { requireUser } from "@trylath/sdk";

const user = await requireUser(req, { environmentId: process.env.LATH_ENV_ID! });

Overview

Get started

Frameworks

Sending

Platform

Surfaces

Sign in your first user