Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.
All 92 tools →
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/clerk-com-sign-ins-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"
Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Clerk Frontend Sign Ins API
version: v1
description: 'The Clerk REST Frontend API, meant to be accessed from a browser or native environment.
This is a Form Based API and all the data must be sent and formatted according to the `application/x-www-form-urlencoded` content type.
### Versions
When the API changes in a way that isn''t compatible with older versions, a new version is released.
Each version is identified by its release date, e.g. `2021-02-05`. For more information, please see [Clerk API Versions](https://clerk.com/docs/backend-requests/versioning/overview).
### Using the Try It Console
The `Try It` feature of the docs only works for **Development Instances** when using the `DevBrowser` security scheme.
To use it, first generate a dev instance token from the `/v1/dev_browser` endpoint.
Please see https://clerk.com/docs for more information.'
x-logo:
url: https://clerk.com/_next/image?url=%2Fimages%2Fclerk-logo.svg&w=96&q=75
altText: Clerk docs
href: https://clerk.com/docs
contact:
email: support@clerk.com
name: Clerk Team
url: https://clerk.com/support
termsOfService: https://clerk.com/terms
license:
name: MIT
url: https://github.com/clerk/javascript/blob/main/LICENSE
servers:
- url: https://{domain}.clerk.accounts.dev
variables:
domain:
default: example-destined-camel-13
description: Your Development Instance Frontend API Domain.
security:
- {}
- DevBrowser: []
- ProductionBrowser: []
- ProductionNativeApp: []
ProductionNativeFlag: []
tags:
- name: Sign Ins
description: Used to sign in a user in the current client.
paths:
/v1/client/sign_ins:
post:
security:
- {}
summary: Create a New Sign in or Replace the Current One.
description: 'Creates or replaces the current Sign in object.
In order to authenticate a Sign in in as few requests as possible,
you can pass in parameters to this request that can identify and verify the Sign in.
Parameter rules:
If the strategy equals `phone_code`, `email_code`, `web3_[provider]_signature`, `reset_password_code` or `reset_password_phone_code` then an identifier is required.
If the strategy equals `email_link` then an identifier is required and optionally redirect_url can be supplied.
If the strategy equals `password` then both an identifier and a password is required.
If the strategy equals `oauth_[provider]` or `saml` then a redirect_url is required, and an action_complete_redirect_url is optional.
If the strategy equals `oauth_token_[provider]` then at least one of code (grant code) or token (openID token) is required. Passing only the token will probably retrieve minimal information about the user from the OAuth provider. You can pass both code and token for the best results.
If the strategy equals `ticket` then ticket is required.
If the strategy equals `passkey` then no identifier is provided.
If the strategy equals `google_one_tap` then token is required.'
tags:
- Sign Ins
operationId: createSignIn
parameters:
- in: header
name: Origin
description: The origin of the request
schema:
type: string
requestBody:
required: false
content:
application/x-www-form-urlencoded:
schema:
type: object
properties:
strategy:
type:
- string
- 'null'
description: 'Strategy used to sign in.
Can be one of `phone_code`, `email_code`, `ticket`, `web3_[provider]_signature` `reset_password_code`, `reset_password_phone_code`, `email_link`, `oauth_[provider]`, `oauth_token_[provider]`, `saml`, `password`, `passkey`, `google_one_tap`'
identifier:
type:
- string
- 'null'
description: The unique identifier of the user. This changes depending on the strategy.
password:
type:
- string
- 'null'
description: The password of the user. Only used with password strategy.
ticket:
type:
- string
- 'null'
description: Ticket to be used for signing in.
redirect_url:
type:
- string
- 'null'
action_complete_redirect_url:
type:
- string
- 'null'
transfer:
type:
- boolean
- 'null'
code:
type:
- string
- 'null'
description: The authorization or grant code for an OAuth exchange. Only used with `oauth_token_[provider]` strategies.
token:
type:
- string
- 'null'
description: The ID token from an OpenID Connect flow. Only used with `oauth_token_[provider]` and `google_one_tap` strategies.
oidc_login_hint:
type:
- string
- 'null'
description: Used with `oauth_[provider]`. The given value will be forwarded to the OIDC `login_hint` parameter of the generated redirect URL.
oidc_prompt:
type:
- string
- 'null'
description: Used with `oauth_[provider]` or `enterprise_sso`. The given value will be forwarded to the OIDC `prompt` parameter of the generated redirect URL. When using shared credentials, this value might be adjusted for security reasons.
responses:
'200':
$ref: '#/components/responses/Client.SignIn'
'307':
description: Redirect, no body.
'400':
$ref: '#/components/responses/ClerkErrors'
'403':
$ref: '#/components/responses/ClerkErrors'
'404':
$ref: '#/components/responses/ClerkErrors'
'409':
$ref: '#/components/responses/ClerkErrors'
'422':
$ref: '#/components/responses/ClerkErrors'
/v1/client/sign_ins/{sign_in_id}:
get:
summary: Retrieve Sign-in
description: 'Returns the sign-in with the given ID.
The sign in is returned only if it belongs to the requesting client and is not abandoned.'
tags:
- Sign Ins
operationId: getSignIn
parameters:
- in: path
name: sign_in_id
required: true
schema:
type: string
description: The ID of the sign in to be retrieved.
responses:
'200':
$ref: '#/components/responses/Client.SignIn'
'400':
$ref: '#/components/responses/ClerkErrors'
'401':
$ref: '#/components/responses/ClerkErrors'
'404':
$ref: '#/components/responses/ClerkErrors'
/v1/client/sign_ins/{sign_in_id}/reset_password:
post:
summary: Reset Password on Sign-in
description: Reset password on sign-in.
tags:
- Sign Ins
operationId: resetPassword
parameters:
- in: path
name: sign_in_id
required: true
schema:
type: string
description: The ID of the sign in to be retrieved.
requestBody:
content:
application/x-www-form-urlencoded:
schema:
type: object
additionalProperties: false
properties:
password:
type: string
sign_out_of_other_sessions:
type:
- boolean
- 'null'
required:
- password
responses:
'200':
$ref: '#/components/responses/responses-Client.SignIn'
'400':
$ref: '#/components/responses/ClerkErrors'
'422':
$ref: '#/components/responses/ClerkErrors'
/v1/client/sign_ins/{sign_in_id}/prepare_first_factor:
post:
summary: Prepare First Factor Verification
description: 'Prepares the verification object for the identified Sign in.
This step authenticates that the user is who they say they are.
Depending on the strategy, this request will do something different.
Parameter actions:
If the strategy equals email_code then this request will send an email with an OTP code.
If the strategy equals phone_code then this request will send an SMS with an OTP code.
If the strategy equals oauth_[provider] then this request generate a URL that the User needs to visit in order to authenticate.
If the strategy equals passkey then this request will begin the passkey registration flow.
Parameter rules:
If the strategy equals `oauth_[provider]` then a redirect_url is required, and an action_complete_redirect_url is optional.'
tags:
- Sign Ins
operationId: prepareSignInFactorOne
parameters:
- in: path
name: sign_in_id
required: true
schema:
type: string
description: The ID of the sign in to be retrieved.
- in: header
name: Origin
description: The origin of the request
schema:
type: string
requestBody:
content:
application/x-www-form-urlencoded:
schema:
type: object
properties:
strategy:
type: string
description: 'The strategy to be prepared for first factor authentication.
Can be one of the following `email_code`, `email_link`,
`phone_code`, `web3_metamask_signature`, `web3_base_signature`, `web3_coinbase_wallet_signature`,
`web3_okx_wallet_signature`, `reset_password_phone_code`, `reset_password_email_code`,
`oauth_[provider]`, `saml`, `passkey`, `enterprise_sso`'
email_address_id:
type:
- string
- 'null'
description: Used with the `email_code`, `reset_password_email_code` and `email_link` strategies.
phone_number_id:
type:
- string
- 'null'
description: Used with the `phone_code` and `reset_password_phone_code` strategies.
web3_wallet_id:
type:
- string
- 'null'
description: Used with the `web3_metamask_signature`, `web3_base_signature`, `web3_coinbase_wallet_signature` and `web3_okx_wallet_signature` strategies.
passkey_id:
type:
- string
- 'null'
description: Used with the `passkey` strategy.
redirect_url:
type:
- string
- 'null'
description: Used with `email_link`, `oauth_[provider]`, and `saml` strategies.
action_complete_redirect_url:
type:
- string
- 'null'
description: Used with `oauth_[provider]` and `saml` strategies.
oidc_login_hint:
type:
- string
- 'null'
description: Used with `oauth_[provider]`. The given value will be forwarded to the OIDC `login_hint` parameter of the generated redirect URL.
oidc_prompt:
type:
- string
- 'null'
description: Used with `oauth_[provider]` or `enterprise_sso`. The given value will be forwarded to the OIDC `prompt` parameter of the generated redirect URL. When using shared credentials this value might be adjusted for security reasons.
required:
- strategy
responses:
'200':
$ref: '#/components/responses/Client.SignIn'
'400':
$ref: '#/components/responses/ClerkErrors'
'403':
$ref: '#/components/responses/ClerkErrors'
'404':
$ref: '#/components/responses/ClerkErrors'
'422':
$ref: '#/components/responses/ClerkErrors'
'429':
$ref: '#/components/responses/ClerkErrors'
/v1/client/sign_ins/{sign_in_id}/attempt_first_factor:
post:
summary: Attempt First Factor Verification
description: 'Attempt the first verification.
Requires the sign in attempt to be identified, and the first factor verification to be prepared, unless you''re using a password.
Parameter rules:
If the strategy equals `email_code` or `phone_code` then a code is required.
If the strategy equals `password` then a password is required.'
tags:
- Sign Ins
operationId: attemptSignInFactorOne
parameters:
- in: path
name: sign_in_id
required: true
schema:
type: string
description: The ID of the sign in.
- in: header
name: Origin
description: The origin of the request
schema:
type: string
requestBody:
content:
application/x-www-form-urlencoded:
schema:
type: object
properties:
strategy:
type: string
description: 'The strategy to be used for first factor authentication.
Can be one of the following `email_code`, `email_link`, `password`, `phone_code`,
`web3_metamask_signature`, `web3_base_signature`, `web3_coinbase_wallet_signature`, `web3_okx_wallet_signature`,
`reset_password_phone_code`, `reset_password_email_code`, `passkey`, `google_one_tap`'
code:
type:
- string
- 'null'
description: The code that was sent to the email. Used with the `email_code`, `phone_code`, and `email_link` strategies.
password:
type:
- string
- 'null'
description: Used with the `password` and `reset_password_phone_code` strategies.
signature:
type:
- string
- 'null'
description: Used with the `web3_metamask_signature`, `web3_base_signature`, `web3_coinbase_wallet_signature` and `web3_okx_wallet_signature` strategies.
token:
type:
- string
- 'null'
description: The ID token from an OpenID Connect flow. Only used with `oauth_token_[provider]` and `google_one_tap` strategies.
ticket:
type:
- string
- 'null'
deprecated: true
public_key_credential:
type:
- string
- 'null'
description: Used with the `passkey` strategy.
required:
- strategy
responses:
'200':
$ref: '#/components/responses/Client.SignIn'
'307':
description: Redirect, no body.
'400':
$ref: '#/components/responses/ClerkErrors'
'403':
$ref: '#/components/responses/ClerkErrors'
'404':
$ref: '#/components/responses/ClerkErrors'
'422':
$ref: '#/components/responses/ClerkErrors'
'429':
$ref: '#/components/responses/ClerkErrors'
/v1/client/sign_ins/{sign_in_id}/prepare_second_factor:
post:
summary: Prepare Second Factor Verification
description: 'Prepare the second verification.
Requires the sign in attempt `status` to be equal to `needs_second_factor` or `needs_client_trust`.'
tags:
- Sign Ins
operationId: prepareSignInFactorTwo
parameters:
- in: path
name: sign_in_id
required: true
schema:
type: string
description: The ID of the sign in.
requestBody:
content:
application/x-www-form-urlencoded:
schema:
type: object
properties:
strategy:
type:
- string
- 'null'
description: The strategy to be prepared for second factor authentication.
enum:
- phone_code
- email_code
- email_link
phone_number_id:
type:
- string
- 'null'
description: Used with the `phone_code` strategy.
email_address_id:
type:
- string
- 'null'
description: Used with the `email_code` and `email_link` strategies.
redirect_url:
type:
- string
- 'null'
description: Used with the `email_link` strategy. The redirect URL after email link verification.
responses:
'200':
$ref: '#/components/responses/Client.SignIn'
'400':
$ref: '#/components/responses/ClerkErrors'
'403':
$ref: '#/components/responses/ClerkErrors'
'422':
$ref: '#/components/responses/ClerkErrors'
/v1/client/sign_ins/{sign_in_id}/attempt_second_factor:
post:
summary: Attempt Second Factor Verification
description: 'Attempt the second verification.
Requires the sign in attempt `status` to be equal to `needs_second_factor` or `needs_client_trust`, and for the preparation step to have been called.'
tags:
- Sign Ins
operationId: attemptSignInFactorTwo
parameters:
- in: path
name: sign_in_id
required: true
schema:
type: string
description: The ID of the sign in.
requestBody:
content:
application/x-www-form-urlencoded:
schema:
type: object
properties:
strategy:
type: string
description: The strategy to be attempted for second factor authentication.
enum:
- email_code
- phone_code
- totp
- backup_code
code:
type: string
description: Used with the `phone_code`, `totp` and `backup_code` strategies.
responses:
'200':
$ref: '#/components/responses/Client.SignIn'
'307':
description: Redirect, no body.
'400':
$ref: '#/components/responses/ClerkErrors'
'403':
$ref: '#/components/responses/ClerkErrors'
'422':
$ref: '#/components/responses/ClerkErrors'
/v1/tickets/accept:
get:
summary: Accept Ticket
description: 'Parses a ticket JWT and performs the necessary actions depending on the ticket''s source type.
Depending on the ticket source type, a successful response can either redirect to a new location
with the ticket in the query string, or respond directly with a text/html content type for the response body.'
operationId: acceptTicket
tags:
- Sign Ins
parameters:
- in: query
name: ticket
required: true
schema:
type: string
description: The JWT with verification information
responses:
'200':
description: Successful response with a plain text or HTML body.
'302':
description: Redirect
'303':
description: Redirect
'400':
$ref: '#/components/responses/ClerkErrors'
'404':
$ref: '#/components/responses/ClerkErrors'
/v1/verify:
get:
summary: Attempt Email Link Verification
description: Attempt to verify a verification with email_link strategy.
operationId: verify
tags:
- Sign Ins
parameters:
- in: query
name: token
required: true
schema:
type: string
description: The JWT with verification information
responses:
'200':
description: OK
'303':
description: Redirect
'400':
$ref: '#/components/responses/ClerkErrors'
components:
schemas:
Stubs.Verification.SAML:
type: object
properties:
object:
type: string
enum:
- verification_saml
status:
type: string
enum:
- unverified
- verified
- failed
- expired
- transferable
strategy:
type: string
enum:
- saml
external_verification_redirect_url:
type:
- string
- 'null'
error:
allOf:
- $ref: '#/components/schemas/ClerkError'
- type:
- object
- 'null'
expire_at:
type:
- integer
- 'null'
attempts:
type:
- integer
- 'null'
required:
- status
- strategy
Stubs.Verification.Link:
type: object
properties:
object:
type: string
enum:
- verification_email_link
status:
type: string
enum:
- unverified
- verified
- failed
- expired
- transferable
strategy:
type: string
enum:
- email_link
attempts:
type:
- integer
- 'null'
expire_at:
type: integer
verified_at_client:
type: string
required:
- status
- strategy
- expire_at
schemas-Client.ClientWrappedSignIn:
type: object
additionalProperties: false
properties:
response:
$ref: '#/components/schemas/Client.SignIn'
client:
$ref: '#/components/schemas/Client.Client'
required:
- response
- client
Client.Passkey:
type: object
additionalProperties: false
properties:
id:
type: string
object:
type: string
description: 'String representing the object''s type. Objects of the same type share the same value.
'
enum:
- passkey
name:
type: string
last_used_at:
type:
- integer
- 'null'
format: int64
description: 'Unix timestamp of when the passkey was last used.
'
verification:
type:
- object
- 'null'
oneOf:
- $ref: '#/components/schemas/Stubs.Verification.Passkey'
created_at:
type: integer
format: int64
description: 'Unix timestamp of creation
'
updated_at:
type: integer
format: int64
description: 'Unix timestamp of update
'
required:
- id
- object
- name
- verification
Stubs.SignInFactor:
type: object
additionalProperties: false
properties:
strategy:
type: string
enum:
- ticket
- password
- email_code
- email_link
- phone_code
- web3_metamask_signature
- web3_base_signature
- web3_coinbase_wallet_signature
- web3_okx_wallet_signature
- web3_solana_signature
- totp
- backup_code
- oauth_apple
- oauth_google
- oauth_facebook
- oauth_hubspot
- oauth_github
- oauth_mock
- oauth_custom_mock
- oauth_token_mock
- saml
- enterprise_sso
- reset_password_email_code
- reset_password_phone_code
- passkey
- google_one_tap
safe_identifier:
type: string
enterprise_connection_id:
type: string
enterprise_connection_name:
type: string
email_address_id:
type: string
phone_number_id:
type: string
web3_wallet_id:
type: string
passkey_id:
type: string
primary:
type:
- boolean
- 'null'
external_verification_redirect_url:
type:
- string
- 'null'
default:
type: boolean
required:
- strategy
Stubs.Verification.BackupCode:
type: object
additionalProperties: false
properties:
object:
type: string
enum:
- verification_backup_code
status:
type: string
enum:
- unverified
- verified
strategy:
type: string
enum:
- backup_code
attempts:
type:
- integer
- 'null'
expire_at:
type:
- integer
- 'null'
required:
- status
- strategy
Stubs.Verification.FromOauth:
type: object
properties:
object:
type: string
enum:
- verification_from_oauth
status:
type: string
enum:
- verified
- unverified
strategy:
type: string
enum:
- from_oauth_apple
- from_oauth_google
- from_oauth_mock
- from_oauth_custom_mock
attempts:
type:
- integer
- 'null'
expire_at:
type:
- integer
- 'null'
required:
- status
- strategy
Token:
type: object
additionalProperties: false
properties:
object:
type: string
description: 'String representing the object''s type. Objects of the same type share the same value.
'
enum:
- token
jwt:
type: string
description: 'String representing the encoded JWT value.
'
required:
- object
- jwt
Stubs.Verification.Admin:
type: object
additionalProperties: false
properties:
object:
type: string
enum:
- verification_admin
status:
type: string
enum:
- verified
- unverified
- failed
- expired
strategy:
type: string
enum:
- admin
attempts:
type:
- integer
- 'null'
expire_at:
type:
- integer
- 'null'
required:
- status
- strategy
Client.SessionBase:
type: object
properties:
id:
type: string
object:
type: string
description: 'String representing the object''s type. Objects of the same type share the same value.
'
enum:
- session
status:
type: string
enum:
- active
- revoked
- ended
- expired
- removed
- abandoned
expire_at:
type: integer
format: int64
abandon_at:
type: integer
format: int64
last_active_at:
type: integer
format: int64
last_active_token:
type:
- object
- 'null'
allOf:
- $ref: '#/components/schemas/Token'
actor:
type:
- object
- 'null'
additionalProperties: true
required:
- id
- object
- status
- expire_at
- abandon_at
- last_active_at
Client.EmailAddress:
type: object
additionalProperties: false
properties:
id:
type: string
object:
type: string
description: 'String representing the object''s type. Objects of the same type share the same value.
'
enum:
- email_address
email_address:
type: string
reserved:
type: boolean
verification:
type:
- object
- 'null'
oneOf:
- $ref: '#/components/schemas/Stubs.Verification.OTP'
- $ref: '#/components/schemas/Stubs.Verification.Invitation'
- $ref: '#/components/schemas/Stubs.Verification.Link'
- $ref: '#/components/schemas/Stubs.Verification.Ticket'
- $ref: '#/components/schemas/Stubs.Verification.Admin'
- $ref: '#/components/schemas/Stubs.Verification.FromOauth'
- $ref: '#/components/schemas/Stubs.Verification.SAML'
linked_to:
type: array
items:
$ref: '#/components/schemas/Stubs.Identification.Link'
matches_sso_connection:
description: 'Indicates whether this email address domain matches an active enterprise connection.
'
type: boolean
created_at:
type: integer
format: int64
description: 'Unix timestamp of creation
'
updated_at:
type: integer
format: int64
description: 'Unix timestamp of creation
'
required:
- id
- object
- email_address
- verification
- linked_to
- reserved
- created_at
- updated_at
ExternalAccountWithVerification:
type: object
additionalProperties: true
properties:
object:
type: string
description: String representing the object's type. Objects of the same type share the same value.
enum:
- external_account
- facebook_account
- google_account
id:
type: string
provider:
type: string
identification_id:
type: string
provider_user_id:
description: The unique ID of the user in the external provider's system
type: string
approved_scopes:
type: string
email_address:
type: string
email_address_verified:
type:
- boolean
- 'null'
description: 'Whether the email was verified by the OAuth provider at creation time. null = unknown (pre-migration data or custom OAuth providers), true = provider confirmed email was verified, false = provider confirmed email was NOT verified
'
first_name:
type: string
last_name:
type: string
avatar_url:
type: string
deprecated: true
description: Please use `image_url` instead
image_url:
type:
- string
- 'null'
username:
type:
- string
- 'null'
phone_number:
type:
- string
- 'null'
public_metadata:
type: object
additionalProperties: true
label:
type:
- string
- 'null'
created_at:
type: integer
format: int64
description: 'Unix timestamp of creation
'
updated_at:
type: integer
format: int64
description: 'Unix timestamp of creation
'
verification:
type:
- object
- 'null'
oneOf:
- $ref: '#/components/schemas/verification_oauth'
- $ref: '#/components/schemas/verification_google_one_tap'
discriminator:
propertyName: object
required:
- object
- id
- provider
- identification_id
- provider_user_id
- approved_scopes
- email_address
- first_name
- last_name
- public_metadata
- created_at
- updated_at
- verification
Client.Orga
# --- truncated at 32 KB (80 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/clerk-com/refs/heads/main/openapi/clerk-com-sign-ins-api-openapi.yml