Projects API

Overview

Projects represent OAuth2 clients — each application that authenticates via the auth service is a project. Projects have their own signing key, client credentials, allowed auth methods, branding, and user list.

List All Projects

Requires super-admin (proj_admin) access.:::

GET /admin/projects
Authorization: Bearer <super_admin_token>

Response

[
  {
    "id": "proj_gym",
    "name": "Gym Tracker",
    "owner_id": "usr_abc123",
    "auth_methods": ["password", "magic_link"],
    "registration": "open",
    "created_at": "2025-01-15T10:00:00Z"
  }
]

Get Project

GET /admin/projects/:projectId
Authorization: Bearer <admin_token>

Response

{
  "id": "proj_gym",
  "name": "Gym Tracker",
  "owner_id": "usr_abc123",
  "redirect_uris": [
    "https://gym.beshoy.ai/api/auth/callback",
    "http://localhost:3001/api/auth/callback"
  ],
  "auth_methods": ["password", "magic_link"],
  "branding": {
    "name": "Gym",
    "primary": "#6366f1",
    "mode": "dark"
  },
  "registration": "open",
  "created_at": "2025-01-15T10:00:00Z"
}

Caution

The signing_key and client_secret_hash are never returned via the API.

Create Project

Requires super-admin access.:::

POST /admin/projects
Authorization: Bearer <super_admin_token>
Content-Type: application/json

Request Body

Field	Type	Required	Description
name	string	Yes	Human-readable project name
owner_id	string	Yes	User ID of the project owner
redirect_uris	string[]	Yes	Allowed OAuth2 redirect URIs
auth_methods	string[]	Yes	["password", "pin", "magic_link"]
branding	object	No	{ name, primary, mode, logo }
registration	string	No	"open", "closed", or "invite_only" (default: "closed")

Example

curl -X POST https://auth.beshoy.ai/admin/projects \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My New App",
    "owner_id": "usr_abc123",
    "redirect_uris": [
      "https://myapp.beshoy.ai/api/auth/callback",
      "http://localhost:3006/api/auth/callback"
    ],
    "auth_methods": ["password", "magic_link"],
    "branding": { "name": "My App", "primary": "#10b981", "mode": "dark" },
    "registration": "closed"
  }'

Response

{
  "id": "proj_abc123",
  "client_secret": "a1b2c3d4e5f6..."
}

Caution

The client_secret is returned only once at creation time. Store it securely — it cannot be retrieved later.

Update Project

PATCH /admin/projects/:projectId
Authorization: Bearer <admin_token>
Content-Type: application/json

Request Body

All fields optional — only include what you want to change:

Field	Type	Description
name	string	Project name
redirect_uris	string[]	Allowed redirect URIs
auth_methods	string[]	Enabled auth methods
branding	object	Branding configuration
registration	string	Registration policy

Example

curl -X PATCH https://auth.beshoy.ai/admin/projects/proj_gym \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "auth_methods": ["password", "magic_link", "pin"],
    "registration": "invite_only"
  }'

Response

{ "ok": true }