# Dropto Auth API

**Canonical:** https://apis.io/apis/dropto-run/dropto-run-auth-api/  
**Provider:** Dropto — https://apis.io/providers/dropto-run/  
**Base URL:** https://dropto.run  
**Documentation:** https://dropto.run/docs/api

Dropto Auth API is one of 13 APIs that [Dropto](https://apis.io/providers/dropto-run/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. This API exposes 6 JSON Schema definitions. Tagged areas include Authentication. The published artifact set on APIs.io includes an OpenAPI specification and 6 JSON Schemas.

Signing in: the browser's redirect through Google, and the two flows a command line uses — one that can open a browser, and one that shows a code to approve from another machine. Sessions are cookies; scripts use a token instead.

## Operations (41)

| Method | Path | Summary |
|---|---|---|
| GET | `/api/auth/2fa` | Describes the code step this browser holds, for the page to name whose it is |
| POST | `/api/auth/2fa/recovery` | Finishes a sign-in with one of the recovery codes |
| POST | `/api/auth/2fa/verify` | Finishes a sign-in with a code from the app |
| POST | `/api/auth/cli/authorize` | Creates the one-time code a waiting command line exchanges for a token |
| POST | `/api/auth/cli/device` | Opens a device sign-in for a command line that cannot receive a browser redirect |
| POST | `/api/auth/cli/device/approve` | Approves or refuses a device sign-in, deciding which account its token speaks… |
| POST | `/api/auth/cli/device/find` | Reports what a device sign-in code is asking for, so it can be approved… |
| POST | `/api/auth/cli/device/token` | Reports whether a device sign-in has been approved, and returns the token once… |
| POST | `/api/auth/cli/token` | Exchanges a one-time code and its verifier for an access token |
| GET | `/api/auth/config` | Reads the OAuth client id and the Turnstile site key. |
| POST | `/api/auth/deletion/cancel` | Redeems the link and restores the person and the accounts going with them |
| POST | `/api/auth/deletion/resend` | Mails a new cancel link when the address has a deletion pending |
| GET | `/api/auth/google` | Redirects to Google's consent screen; returnTo is where the browser lands after… |
| POST | `/api/auth/google/one-tap` | Verifies the ID token, upserts the user, and signs the cookie in |
| POST | `/api/auth/link` | Looks the link up and returns the address it was mailed to, and which kind of… |
| POST | `/api/auth/login` | Checks the password and, when it matches a confirmed account, signs the person… |
| POST | `/api/auth/logout` | Signs the caller out of the cookie scheme. Safe to call with no session |
| POST | `/api/auth/password/forgot` | Mails a reset link when the address has an account |
| POST | `/api/auth/password/reset` | Redeems the link, sets the password, and signs the person in |
| POST | `/api/auth/signup` | Creates the account, or mails the right thing about an existing one |
| POST | `/api/auth/verify` | Redeems the link and does what its purpose says |
| POST | `/api/auth/verify/resend` | Checks the password and, for an unconfirmed account, mails a new link |
| DELETE | `/api/me` | Schedules the deletion, takes everything offline, and signs this browser out |
| GET | `/api/me` | Reads the signed-in user, their plan and usage |
| PATCH | `/api/me` | Sets or clears the signed-in person's name |
| DELETE | `/api/me/2fa` | Checks the proof and forgets the person's two-factor |
| POST | `/api/me/2fa/enable` | Checks the code, turns two-factor on, and issues the recovery codes |
| POST | `/api/me/2fa/recovery-codes` | Makes a new set |
| POST | `/api/me/2fa/start` | Makes and stores a new unconfirmed key |
| DELETE | `/api/me/devices` | Forgets every browser, this one included |
| GET | `/api/me/devices` | Lists the signed-in person's trusted browsers |
| DELETE | `/api/me/devices/{id}` | Forgets one browser |
| POST | `/api/me/email` | Checks who is asking, then issues the confirmation link and queues both mails |
| DELETE | `/api/me/email/pending` | Retires every change of address still open for the signed-in person |
| GET | `/api/me/export` | Gathers the person's data and streams it as a file to save |
| DELETE | `/api/me/google` | Clears the Google subject from the signed-in person's row |
| PUT | `/api/me/onboarding` | Stores the answers, and marks the row finished when every question has one |
| POST | `/api/me/password` | Checks the current password, sets the new one, and re-issues this browser's… |
| PUT | `/api/me/product-email` | Gives or withdraws consent to product email |
| GET | `/api/me/profile` | Reads the signed-in person: name, address, and how they sign in |
| POST | `/api/me/sessions/revoke` | Rotates the stamp and clears this response's cookie |

## Machine-readable artifacts (7)

- **OpenAPI** — https://artifacts.apis.io/dropto-run/openapi/dropto-run-auth-api-openapi.yml
- **JSONSchema** — https://artifacts.apis.io/dropto-run/json-schema/dropto-run-site-detail-schema.json
- **JSONSchema** — https://artifacts.apis.io/dropto-run/json-schema/dropto-run-update-site-settings-request-schema.json
- **JSONSchema** — https://artifacts.apis.io/dropto-run/json-schema/dropto-run-site-domain-response-schema.json
- **JSONSchema** — https://artifacts.apis.io/dropto-run/json-schema/dropto-run-me-response-schema.json
- **JSONSchema** — https://artifacts.apis.io/dropto-run/json-schema/dropto-run-site-traffic-overview-schema.json
- **JSONSchema** — https://artifacts.apis.io/dropto-run/json-schema/dropto-run-site-settings-response-schema.json

## Other Dropto APIs (12)

- [Dropto Abuse API](https://apis.io/apis/dropto-run/dropto-run-abuse-api/)
- [Dropto Account API](https://apis.io/apis/dropto-run/dropto-run-account-api/)
- [Dropto Announcements API](https://apis.io/apis/dropto-run/dropto-run-announcements-api/)
- [Dropto Billing API](https://apis.io/apis/dropto-run/dropto-run-billing-api/)
- [Dropto Deploys API](https://apis.io/apis/dropto-run/dropto-run-deploys-api/)
- [Dropto Health API](https://apis.io/apis/dropto-run/dropto-run-health-api/)
- [Dropto Plans API](https://apis.io/apis/dropto-run/dropto-run-plans-api/)
- [Dropto Promotions API](https://apis.io/apis/dropto-run/dropto-run-promotions-api/)
- [Dropto Site folders API](https://apis.io/apis/dropto-run/dropto-run-site-folders-api/)
- [Dropto Sites API](https://apis.io/apis/dropto-run/dropto-run-sites-api/)
- [Dropto Support API](https://apis.io/apis/dropto-run/dropto-run-support-api/)
- [Dropto Tokens API](https://apis.io/apis/dropto-run/dropto-run-tokens-api/)

## Tags

Authentication

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/dropto-run/dropto-run-auth-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/dropto-run/.