Medusa

Medusa Auth API

Auth API routes allow you to manage an admin user's authentication.

GitHub OpenAPI

Operations 19

DELETE /auth/mfa/factors/{id} Disable a Multi-Factor Authentication (MFA) Factor #
POST /auth/session Set Authentication Session #
DELETE /auth/session Delete Authentication Session #
POST /auth/token/refresh Refresh Authentication Token #
GET /auth/user/providers List Auth Providers for Admin Users #
POST /auth/user/{auth_provider} Authenticate User #
POST /auth/user/{auth_provider}/callback Validate Authentication Callback #
POST /auth/user/{auth_provider}/register Retrieve Registration JWT Token #
POST /auth/user/{auth_provider}/reset-password Generate Reset Password Token for Admin User #
POST /auth/user/{auth_provider}/update Reset an Admin User's Password #
POST /auth/customer/emailpass/verification/confirm Verify the Customer's Email #
GET /auth/customer/providers List Auth Providers for Customers #
POST /auth/customer/{auth_provider} Authenticate Customer #
POST /auth/customer/{auth_provider}/callback Validate Authentication Callback #
POST /auth/customer/{auth_provider}/register Retrieve Registration JWT Token #
POST /auth/customer/{auth_provider}/reset-password Generate Reset Password Token for Customer #
POST /auth/customer/{auth_provider}/update Reset a Customer's Password #
POST /auth/verification/confirm Confirm Customer Verification #
POST /auth/verification/request Request Customer Verification #

Documentation

📖
Documentation
https://docs.medusajs.com/api/store
📖
APIReference
https://docs.medusajs.com/api/store
📖
Authentication
https://docs.medusajs.com/api/store#authentication
📖
Documentation
https://docs.medusajs.com/api/admin
📖
APIReference
https://docs.medusajs.com/api/admin
📖
Authentication
https://docs.medusajs.com/api/admin#authentication

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/medusa/refs/heads/main/openapi/medusa-auth-api-openapi.yml

Other Resources

🔗
OpenAPI Source
https://raw.githubusercontent.com/medusajs/medusa/develop/www/apps/api-reference/specs/store/openapi.full.yaml
🔗
OpenAPI Source
https://raw.githubusercontent.com/medusajs/medusa/develop/www/apps/api-reference/specs/admin/openapi.full.yaml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/medusa-auth-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

medusa-auth-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Medusa Auth API
  version: 2.19.0
  description: 'Operations tagged Auth across 2 of this provider''s published API definitions: medusa-admin-openapi.yaml, medusa-store-openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: http://localhost:9000
- url: https://api.medusajs.com
tags:
- name: Auth
  description: 'Auth API routes allow you to manage an admin user''s authentication.

    '
paths:
  /auth/mfa/factors/{id}:
    delete:
      operationId: DeleteMfaFactorsId
      summary: Disable a Multi-Factor Authentication (MFA) Factor
      x-sidebar-summary: Disable MFA Factor
      description: 'Disable a multi-factor authentication (MFA) factor for the authenticated user. Once disabled,

        the factor can no longer be used to verify MFA challenges. When disabling a recovery-code

        factor, a valid recovery code must be provided in the request body.

        '
      x-authenticated: true
      parameters:
      - name: id
        in: path
        description: The MFA factor's ID.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              description: The details required to disable the MFA factor.
              properties:
                method:
                  type: string
                  title: method
                  description: The MFA method used to authorize disabling the factor (for example, `recovery-code`).
                code:
                  type: string
                  title: code
                  description: The verification code associated with the provided `method`, used to confirm the disable action.
      x-codeSamples:
      - lang: JavaScript
        label: JS SDK
        source: "import Medusa from \"@medusajs/js-sdk\"\n\nexport const sdk = new Medusa({\n  baseUrl: import.meta.env.VITE_BACKEND_URL || \"/\",\n  debug: import.meta.env.DEV,\n  auth: {\n    type: \"session\",\n  },\n})\n\nconst { mfa_factor } = await sdk.auth.mfa.disable(\"authmfa_123\")"
      - lang: Shell
        label: cURL
        source: curl -X DELETE '{backend_url}/auth/mfa/factors/{id}'
      tags:
      - Auth
      responses:
        '200':
          description: OK
        '400':
          $ref: '#/components/responses/400_error'
        '401':
          $ref: '#/components/responses/unauthorized'
        '404':
          $ref: '#/components/responses/not_found_error'
        '409':
          $ref: '#/components/responses/invalid_state_error'
        '422':
          $ref: '#/components/responses/invalid_request_error'
        '500':
          $ref: '#/components/responses/500_error'
      x-since: 2.15.3
    servers:
    - url: http://localhost:9000
    - url: https://api.medusajs.com
  /auth/session:
    post:
      operationId: PostSession
      summary: Set Authentication Session
      description: Set the cookie session ID of an admin user. The admin must be previously authenticated with the `/auth/user/{provider}` API route first, as the JWT token is required in the header of the request.
      x-authenticated: true
      x-codeSamples:
      - lang: Shell
        label: cURL
        source: 'curl -X POST ''{backend_url}/auth/session'' \

          -H ''Authorization: Bearer {jwt_token}'''
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthAdminSessionResponse'
        '400':
          $ref: '#/components/responses/400_error'
        '401':
          $ref: '#/components/responses/unauthorized'
        '404':
          $ref: '#/components/responses/not_found_error'
        '409':
          $ref: '#/components/responses/invalid_state_error'
        '422':
          $ref: '#/components/responses/invalid_request_error'
        '500':
          $ref: '#/components/responses/500_error'
    delete:
      operationId: DeleteSession
      summary: Delete Authentication Session
      description: Deletes the cookie session ID previously set for authentication.
      x-authenticated: true
      x-codeSamples:
      - lang: JavaScript
        label: JS SDK
        source: "import Medusa from \"@medusajs/js-sdk\"\n\nexport const sdk = new Medusa({\n  baseUrl: import.meta.env.VITE_BACKEND_URL || \"/\",\n  debug: import.meta.env.DEV,\n  auth: {\n    type: \"session\",\n  },\n})\n\nawait sdk.auth.logout()\n\n// user is now logged out\n// you can't send any requests that require authentication"
      - lang: Shell
        label: cURL
        source: 'curl -X DELETE ''{backend_url}/auth/session'' \

          -H ''Cookie: connect.sid={sid}'''
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                description: The deletion's details.
                required:
                - success
                properties:
                  success:
                    type: boolean
                    title: success
                    description: Whether the session was deleted successfully.
        '400':
          $ref: '#/components/responses/400_error'
        '401':
          $ref: '#/components/responses/unauthorized'
        '404':
          $ref: '#/components/responses/not_found_error'
        '409':
          $ref: '#/components/responses/invalid_state_error'
        '422':
          $ref: '#/components/responses/invalid_request_error'
        '500':
          $ref: '#/components/responses/500_error'
    servers:
    - url: http://localhost:9000
    - url: https://api.medusajs.com
  /auth/token/refresh:
    post:
      operationId: PostAdminAuthTokenRefresh
      summary: Refresh Authentication Token
      description: Refresh the authentication token of a user. This is useful after authenticating a user with a third-party service to ensure the token holds the new user's details, or when you don't want users to re-login every day.
      externalDocs:
        url: https://docs.medusajs.com/resources/commerce-modules/auth/authentication-route#2-third-party-service-authenticate-flow
        description: Learn about third-party authentication flow.
      x-authenticated: true
      x-codeSamples:
      - lang: JavaScript
        label: JS SDK
        source: "import Medusa from \"@medusajs/js-sdk\"\n\nexport const sdk = new Medusa({\n  baseUrl: import.meta.env.VITE_BACKEND_URL || \"/\",\n  debug: import.meta.env.DEV,\n  auth: {\n    type: \"session\",\n  },\n})\n\nconst token = await sdk.auth.refresh()\n\n// all subsequent requests will use the token in the header\nconst { user } = await sdk.admin.user.me()"
      - lang: Shell
        label: cURL
        source: 'curl -X POST ''{backend_url}/auth/token/refresh'' \

          -H ''Authorization: Bearer {token}'''
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '400':
          $ref: '#/components/responses/400_error'
        '401':
          $ref: '#/components/responses/unauthorized'
        '404':
          $ref: '#/components/responses/not_found_error'
        '409':
          $ref: '#/components/responses/invalid_state_error'
        '422':
          $ref: '#/components/responses/invalid_request_error'
        '500':
          $ref: '#/components/responses/500_error'
    servers:
    - url: http://localhost:9000
    - url: https://api.medusajs.com
  /auth/user/providers:
    get:
      operationId: GetUserProviders
      x-sidebar-summary: List Providers
      summary: List Auth Providers for Admin Users
      description: Retrieve a list of auth providers for the user actor type. This is useful to show the authentication option for the available providers.
      x-authenticated: false
      x-codeSamples:
      - lang: JavaScript
        label: JS SDK
        source: "import Medusa from \"@medusajs/js-sdk\"\n\nexport const sdk = new Medusa({\n  baseUrl: import.meta.env.VITE_BACKEND_URL || \"/\",\n  debug: import.meta.env.DEV,\n  auth: {\n    type: \"session\",\n  },\n})\n\nconst { providers } = await sdk.auth.listProviders(\"user\")"
      - lang: Shell
        label: cURL
        source: curl '{backend_url}/auth/user/providers'
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProvidersListResponse'
        '400':
          $ref: '#/components/responses/400_error'
        '401':
          $ref: '#/components/responses/unauthorized'
        '404':
          $ref: '#/components/responses/not_found_error'
        '409':
          $ref: '#/components/responses/invalid_state_error'
        '422':
          $ref: '#/components/responses/invalid_request_error'
        '500':
          $ref: '#/components/responses/500_error'
    servers:
    - url: http://localhost:9000
    - url: https://api.medusajs.com
  /auth/user/{auth_provider}:
    post:
      operationId: PostActor_typeAuth_provider
      summary: Authenticate User
      description: 'Authenticate a user and receive the JWT token to be used in the header of subsequent requests.


        When used with a third-party provider, such as Google, the request returns a `location` property. You redirect to the specified URL in your frontend to continue authentication with the third-party service.

        '
      externalDocs:
        url: https://docs.medusajs.com/resources/commerce-modules/auth/authentication-route#types-of-authentication-flows
        description: Learn about different authentication flows.
      x-authenticated: false
      parameters:
      - name: auth_provider
        in: path
        description: The provider used for authentication.
        required: true
        schema:
          type: string
          example: emailpass
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: input
              description: "The input data necessary for authentication. \nFor example, for email-pass authentication, pass `email` and `password` properties. \nFor the Google and GitHub authentication providers, you can pass `callback_url` to indicate the URL in the frontend that the user should be redirected to after completing their authentication. This will override the provider's `callbackUrl` configurations in `medusa-config.ts`.\n"
      x-codeSamples:
      - lang: JavaScript
        label: JS SDK
        source: "import Medusa from \"@medusajs/js-sdk\"\n\nexport const sdk = new Medusa({\n  baseUrl: import.meta.env.VITE_BACKEND_URL || \"/\",\n  debug: import.meta.env.DEV,\n  auth: {\n    type: \"session\",\n  },\n})\n\nconst result = await sdk.auth.login(\n  \"user\",\n  \"emailpass\",\n  {\n    email: \"user@gmail.com\",\n    password: \"supersecret\"\n  }\n)\n\nif (typeof result !== \"string\") {\n  alert(\"Authentication requires additional steps\")\n  // replace with the redirect logic of your application\n  window.location.href = result.location\n  return\n}\n\n// user is now authenticated\n// all subsequent requests will use the token in the header\nconst { user } = await sdk.admin.user.me()"
      - lang: Bash
        label: Google Provider
        source: curl -X POST '{backend_url}/auth/user/google'
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/AuthResponse'
                - $ref: '#/components/schemas/AuthCallbackResponse'
        '400':
          $ref: '#/components/responses/400_error'
        '401':
          $ref: '#/components/responses/unauthorized'
        '404':
          $ref: '#/components/responses/not_found_error'
        '409':
          $ref: '#/components/responses/invalid_state_error'
        '422':
          $ref: '#/components/responses/invalid_request_error'
        '500':
          $ref: '#/components/responses/500_error'
    servers:
    - url: http://localhost:9000
    - url: https://api.medusajs.com
  /auth/user/{auth_provider}/callback:
    post:
      operationId: PostActor_typeAuth_providerCallback
      summary: Validate Authentication Callback
      description: 'This API route is used by your dashboard or frontend application when a third-party provider redirects to it after authentication. It validates the authentication with the third-party provider and, if successful, returns an authentication token. All query parameters received from the third-party provider, such as `code`, `state`, and `error`, must be passed as query parameters to this route.


        You can decode the JWT token using libraries like [react-jwt](https://www.npmjs.com/package/react-jwt) in the frontend. If the decoded data doesn''t  have an `actor_id` property, then you must create a user, typically using the Accept Invite route passing the token in the request''s Authorization header.

        '
      externalDocs:
        url: https://docs.medusajs.com/resources/commerce-modules/auth/authentication-route#2-third-party-service-authenticate-flow
        description: Learn about third-party authentication flow.
      x-authenticated: false
      parameters:
      - name: auth_provider
        in: path
        description: The provider used for authentication.
        required: true
        schema:
          type: string
          example: google
      x-codeSamples:
      - lang: JavaScript
        label: Google Provider
        source: "import Medusa from \"@medusajs/js-sdk\"\nimport { decodeToken } from \"react-jwt\"\n\nexport const sdk = new Medusa({\n  baseUrl: import.meta.env.VITE_BACKEND_URL || \"/\",\n  debug: import.meta.env.DEV,\n  auth: {\n    type: \"session\",\n  },\n})\n\nconst token = await sdk.auth.callback(\n  \"user\",\n  \"google\",\n  {\n    code: \"123\",\n    state: \"456\"\n  }\n)\n// all subsequent requests will use the token in the header\n\nconst decodedToken = decodeToken(token) as { actor_id: string, user_metadata: Record<string, unknown> }\n\nconst shouldCreateUser = decodedToken.actor_id === \"\"\n\nif (shouldCreateUser) {\n  const user = await sdk.admin.invite.accept(\n    {\n      email: decodedToken.user_metadata.email as string,\n      first_name: \"John\",\n      last_name: \"Smith\",\n      invite_token: \"12345...\"\n    },\n  )\n\n  // refresh auth token\n  await sdk.auth.refresh()\n  // all subsequent requests will use the new token in the header\n} else {\n  // User already exists and is authenticated\n}"
      - lang: TypeScript
        label: GitHub Provider
        source: "import Medusa from \"@medusajs/js-sdk\"\nimport { decodeToken } from \"react-jwt\"\n\nexport const sdk = new Medusa({\n  baseUrl: import.meta.env.VITE_BACKEND_URL || \"/\",\n  debug: import.meta.env.DEV,\n  auth: {\n    type: \"session\",\n  },\n})\n\nconst token = await sdk.auth.callback(\n  \"user\",\n  \"github\",\n  {\n    code: \"123\",\n    state: \"456\"\n  }\n)\n// all subsequent requests will use the token in the header\n\nconst decodedToken = decodeToken(token) as { actor_id: string, user_metadata: Record<string, unknown> }\n\nconst shouldCreateUser = decodedToken.actor_id === \"\"\n\nif (shouldCreateUser) {\n  const user = await sdk.admin.invite.accept(\n    {\n      email: decodedToken.user_metadata.email as string,\n      first_name: \"John\",\n      last_name: \"Smith\",\n      invite_token: \"12345...\"\n    },\n  )\n\n  // refresh auth token\n  await sdk.auth.refresh()\n  // all subsequent requests will use the new token in the header\n} else {\n  // User already exists and is authenticated\n}"
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '400':
          $ref: '#/components/responses/400_error'
        '401':
          $ref: '#/components/responses/unauthorized'
        '404':
          $ref: '#/components/responses/not_found_error'
        '409':
          $ref: '#/components/responses/invalid_state_error'
        '422':
          $ref: '#/components/responses/invalid_request_error'
        '500':
          $ref: '#/components/responses/500_error'
    servers:
    - url: http://localhost:9000
    - url: https://api.medusajs.com
  /auth/user/{auth_provider}/register:
    post:
      operationId: PostActor_typeAuth_provider_register
      summary: Retrieve Registration JWT Token
      description: This API route retrieves a registration JWT token of a user that hasn't been registered yet. The token is used in the header of requests that create a user, such as the Accept Invite API route.
      externalDocs:
        url: https://docs.medusajs.com/resources/commerce-modules/auth/authentication-route#1-basic-authentication-flow
        description: Learn about the basic authentication flow.
      x-authenticated: false
      parameters:
      - name: auth_provider
        in: path
        description: The provider used for authentication.
        required: true
        schema:
          type: string
          example: emailpass
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: input
              description: The input data necessary for authentication. For example, for email-pass authentication, pass `email` and `password` properties.
              example:
                email: admin@medusa-test.com
                password: supersecret
      x-codeSamples:
      - lang: JavaScript
        label: JS SDK
        source: "import Medusa from \"@medusajs/js-sdk\"\n\nexport const sdk = new Medusa({\n  baseUrl: import.meta.env.VITE_BACKEND_URL || \"/\",\n  debug: import.meta.env.DEV,\n  auth: {\n    type: \"session\",\n  },\n})\n\nconst token = await sdk.auth.register(\"user\", \"emailpass\", {\n  email: \"user@gmail.com\",\n  password: \"supersecret\"\n})\n\n// all subsequent requests will use the token in the header\nconst { user } = await sdk.admin.invite.accept(\n  {\n    email: \"user@gmail.com\",\n    first_name: \"John\",\n    last_name: \"Smith\",\n    invite_token: \"12345...\"\n  },\n)"
      - lang: Shell
        label: cURL
        source: "curl -X POST '{backend_url}/auth/user/emailpass/register' \\\n-H 'Content-Type: application/json' \\\n--data-raw '{\n  \"email\": \"admin@medusa-test.com\",\n  \"password\": \"supersecret\"\n}'"
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '400':
          $ref: '#/components/responses/400_error'
        '401':
          $ref: '#/components/responses/unauthorized'
        '404':
          $ref: '#/components/responses/not_found_error'
        '409':
          $ref: '#/components/responses/invalid_state_error'
        '422':
          $ref: '#/components/responses/invalid_request_error'
        '500':
          $ref: '#/components/responses/500_error'
    servers:
    - url: http://localhost:9000
    - url: https://api.medusajs.com
  /auth/user/{auth_provider}/reset-password:
    post:
      operationId: PostActor_typeAuth_providerResetPassword
      summary: Generate Reset Password Token for Admin User
      x-sidebar-summary: Generate Reset Password Token
      description: "Generate a reset password token for an admin user. This API route doesn't reset the admin's password or send them the reset instructions in a notification.\n\nInstead, This API route emits the `auth.password_reset` event, passing it the token as a payload. You can listen to that event in a subscriber as explained in [this guide](https://docs.medusajs.com/resources/commerce-modules/auth/reset-password), then send the user a notification. The notification is sent using a [Notification Module Provider](https://docs.medusajs.com/resources/infrastructure-modules/notification), and it should have the URL to reset the password in the Medusa Admin dashboard, such as `http://localhost:9000/app/reset-password?token=123`.\n\n\n Use the generated token to update the user's password using the [Reset Password API route](https://docs.medusajs.com/api/admin#auth_postactor_typeauth_providerupdate).\n"
      externalDocs:
        url: https://docs.medusajs.com/resources/commerce-modules/auth/authentication-route#generate-reset-password-token-route
        description: Learn more about this API route.
      x-authenticated: false
      parameters:
      - name: auth_provider
        in: path
        description: The provider used for authentication.
        required: true
        schema:
          type: string
          example: emailpass
      requestBody:
        content:
          application/json:
            schema:
              type: object
              description: The input data necessary to generate a reset password token.
              required:
              - identifier
              properties:
                identifier:
                  type: string
                  description: The identifier of the admin user. For example, their email address.
                  example: admin@medusa-test.com
                metadata:
                  type: object
                  description: Optional metadata to include with the reset password token generation request.
      x-codeSamples:
      - lang: JavaScript
        label: JS SDK
        source: "import Medusa from \"@medusajs/js-sdk\"\n\nexport const sdk = new Medusa({\n  baseUrl: import.meta.env.VITE_BACKEND_URL || \"/\",\n  debug: import.meta.env.DEV,\n  auth: {\n    type: \"session\",\n  },\n})\n\nsdk.auth.resetPassword(\n  \"user\",\n  \"emailpass\",\n  {\n    identifier: \"user@gmail.com\"\n  }\n)\n.then(() => {\n  // user receives token\n})"
      - lang: Shell
        label: cURL
        source: "curl -X POST '{backend_url}/auth/user/emailpass/reset-password' \\\n-H 'Content-Type: application/json' \\\n--data-raw '{\n  \"identifier\": \"admin@medusa-test.com\"\n}'"
      tags:
      - Auth
      responses:
        '201':
          description: OK
          content:
            text/plain:
              schema:
                type: string
                title: message
                description: The 201 status code's message.
                example: Created
        '400':
          $ref: '#/components/responses/400_error'
        '401':
          $ref: '#/components/responses/unauthorized'
        '404':
          $ref: '#/components/responses/not_found_error'
        '409':
          $ref: '#/components/responses/invalid_state_error'
        '422':
          $ref: '#/components/responses/invalid_request_error'
        '500':
          $ref: '#/components/responses/500_error'
      x-workflow: generateResetPasswordTokenWorkflow
      x-events:
      - name: auth.password_reset
        payload: "```ts\n{\n  entity_id, // The identifier of the user or customer. For example, an email address.\n  actor_type, // The type of actor. For example, \"customer\", \"user\", or custom.\n  token, // The generated token.\n  metadata, // Optional custom metadata passed from the request.\n}\n```"
        description: 'Emitted when a reset password token is generated. You can listen to this event

          to send a reset password email to the user or customer, for example.'
        deprecated: false
    servers:
    - url: http://localhost:9000
    - url: https://api.medusajs.com
  /auth/user/{auth_provider}/update:
    post:
      operationId: PostActor_typeAuth_providerUpdate
      summary: Reset an Admin User's Password
      x-sidebar-summary: Reset Password
      description: Reset an admin user's password using a reset-password token generated with the [Generate Reset Password Token API route](https://docs.medusajs.com/api/admin#auth_postactor_typeauth_providerresetpassword). You pass the token as a bearer token in the request's Authorization header.
      externalDocs:
        url: https://docs.medusajs.com/resources/commerce-modules/auth/authentication-route#reset-password-route
        description: Learn more about this API route.
      x-authenticated: true
      parameters:
      - name: auth_provider
        in: path
        description: The provider used for authentication.
        required: true
        schema:
          type: string
          example: emailpass
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: input
              description: The input data necessary for authentication. For example, for email-pass authentication, pass `email` and `password` properties.
              example:
                email: admin@medusa-test.com
                password: supersecret
      x-codeSamples:
      - lang: JavaScript
        label: JS SDK
        source: "import Medusa from \"@medusajs/js-sdk\"\n\nexport const sdk = new Medusa({\n  baseUrl: import.meta.env.VITE_BACKEND_URL || \"/\",\n  debug: import.meta.env.DEV,\n  auth: {\n    type: \"session\",\n  },\n})\n\nsdk.auth.updateProvider(\n  \"user\",\n  \"emailpass\",\n  {\n    password: \"supersecret\"\n  },\n  token\n)\n.then(() => {\n  // password updated\n})"
      - lang: Shell
        label: cURL
        source: "curl -X POST '{backend_url}/auth/user/emailpass/update' \\\n-H 'Content-Type: application/json' \\\n-H 'Authorization: Bearer {token}' \\\n--data-raw '{\n  \"email\": \"admin@medusa-test.com\",\n  \"password\": \"supersecret\"\n}'"
      security:
      - reset_password: []
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                required:
                - success
                description: Details on the reset password's status.
                properties:
                  success:
                    type: boolean
                    title: success
                    description: Whether the password was reset successfully.
        '400':
          $ref: '#/components/responses/400_error'
        '401':
          $ref: '#/components/responses/unauthorized'
        '404':
          $ref: '#/components/responses/not_found_error'
        '409':
          $ref: '#/components/responses/invalid_state_error'
        '422':
          $ref: '#/components/responses/invalid_request_error'
        '500':
          $ref: '#/components/responses/500_error'
    servers:
    - url: http://localhost:9000
    - url: https://api.medusajs.com
  /auth/customer/emailpass/verification/confirm:
    post:
      operationId: PostActor_typeAuth_providerVerificationConfirm
      summary: Verify the Customer's Email
      description: Verifies the customer's email using a token that is typically sent to their email address. This is used to confirm the customer's email during registration or authentication when [email verification is required](https://docs.medusajs.com/resources/commerce-modules/auth/auth-providers/emailpass). You can listen to the `auth.verification_requested` event in a subscriber and send an email to the customer with the verification token.
      x-authenticated: false
      requestBody:
        content:
          application/json:
            schema:
              type: object
              description: The details required to verify the customer's email.
              required:
              - token
              properties:
                token:
                  type: string
                  title: token
                  description: The verification token sent to the customer's email address.
      x-codeSamples:
      - lang: Shell
        label: cURL
        source: "curl -X POST '{backend_url}/auth/customer/emailpass/verification/confirm' \\\n-H 'Content-Type: application/json' \\\n--data-raw '{\n  \"token\": \"{value}\"\n}'"
      tags:
      - Auth
      responses:
        '200':
          description: OK
        '400':
          $ref: '#/components/responses/400_error'
        '401':
          $ref: '#/components/responses/unauthorized'
        '404':
          $ref: '#/components/responses/not_found_error'
        '409':
          $ref: '#/components/responses/invalid_state_error'
        '422':
          $ref: '#/components/responses/invalid_request_error'
        '500':
          $ref: '#/components/responses/500_error'
    servers:
    - url: http://localhost:9000
    - url: https://api.medusajs.com
  /auth/customer/providers:
    get:
      operationId: GetCustomerProviders
      x-sidebar-summary: List Providers
      summary: List Auth Providers for Customers
      description: Retrieve a list of auth providers for the customer actor type. This is useful to show the authentication option for the available providers.
      x-authenticated: false
      x-codeSamples:
      - lang: JavaScript
        label: JS SDK
        source: "import Medusa from \"@medusajs/js-sdk\"\n\nexport const sdk = new Medusa({\n  baseUrl: import.meta.env.VITE_BACKEND_URL || \"/\",\n  debug: import.meta.env.DEV,\n  auth: {\n    type: \"session\",\n  },\n})\n\nconst { providers } = await sdk.auth.listProviders(\"customer\")"
      - lang: Shell
        label: cURL
        source: curl '{backend_url}/auth/customer/providers'
      tags:
      - Auth
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProvidersListResponse'
        '400':
          $ref: '#/components/responses/400_error'
        '401':
          $ref: '#/components/responses/unauthorized'
        '404':
          $ref: '#/components/responses/not_found_error'
        '409':
          $ref: '#/components/responses/invalid_state_error'
        '422':
          $ref: '#/components/responses/invalid_request_error'
        '500':
          $ref: '#/components/responses/500_error'
    servers:
    - url: http://localhost:9000
    - url: https://api.medusajs.com
  /auth/customer/{auth_provider}:
    post:
      operationId: PostActor_typeAuth_provider
      summary: Authenticate Customer
      description: 'Authenticate a customer and receive the JWT token to be used in the header of subsequent requests.


        When used with a third-party provider, such as Google, the request returns a `location` property. You redirect to the specified URL in your storefront to continue authentication with the third-party service.

        '
      externalDocs:
        url: https://docs.medusajs.com/resources/storefront-development/customers/login#1-using-a-jwt-token
        description: 'Storefront development: How to login as a customer'
      x-authenticated: false
      parameters:
      - name: auth_provider
        in: path
        description: The provider used for authentication.
        required: true
        schema:
          type: string
          example: emailpass
      requestBody:
        content:
          application/json:
            schema:
              type: object
              title: input
              description: "The input data necessary for authentication. \nFor example, for email-pass authentication, pass `email` and `password` properties. \nFor the Google and GitHub authentication providers, you can pass `callback_url` to indicate the URL in the frontend that the customer should be redirected to after completing their authentication. This will override the provider's `callbackUrl` configurations in `medusa-config.ts`.\n"
      x-codeSamples:
      - lang: JavaScript
        label: JS SDK
        source: "import Medusa from \"@medusajs/js-sdk\"\n\nlet MEDUSA_BACKEND_URL = \"http://localhost:9000\"\n\nif (process.env.NEXT_PUBLIC_MEDUSA_BACKEND_URL) {\n  MEDUSA_BACKEND_URL = process.env.NEXT_PUBLIC_MEDUSA_BACKEND_URL\n}\n\nexport const sdk = new Medusa({\n  baseUrl: MEDUSA_BACKEND_URL,\n  debug: process.env.NODE_ENV === \"development\",\n  publishableKey: process.env.NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY,\n})\n\nconst result = await sdk.auth.login(\n  \"customer\",\n  \"emailpass\",\n  {\n    email: \"customer@gmail.com\",\n    password: \"supersecret\"\n  }\n)\n\nif (typeof result !== \"string\") {\n  alert(\"Authentication requires additional steps\")\n  // replace

# --- truncated at 32 KB (69 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/medusa/refs/heads/main/openapi/medusa-auth-api-openapi.yml