Authentication

End-to-end developer runbook

1. Step 1 - Confirm the API area: Identify the product area, route module, endpoint path, and consumer before writing or calling code.
2. Step 2 - Read the endpoint contract: Check method, auth, parameters, response, errors, side effects, and related docs.
3. Step 3 - Prepare authentication and input: Use the right session, bearer token, webhook secret, or internal header. Validate body and query data before sending it.
4. Step 4 - Make the request: Call the endpoint from the correct origin and environment. Keep credentials and secrets out of logs.
5. Step 5 - Verify response, side effects, and records: Confirm status code, response shape, database records, external side effects, and audit evidence.
6. Step 6 - Add tests, docs, and handoff notes: Update route inventory, consumer notes, and certification checks before depending on the change.

Family summary

Dashboard auth, Supabase Auth hooks, access checks, session helpers, and permission discovery.

Modules audited

• auth.ts: 25 generated endpoint entries.
• authEmail.ts: 1 generated endpoint entries.
• access.ts: 5 generated endpoint entries.

Endpoint table

Method	Path	Module	Auth scan	Source
GET	/api/access	access.ts	Partner dashboard session required.	partners-api/src/routes/access.ts:32
GET	/api/cms-token	access.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/access.ts:291
GET	/api/partner-directory	access.ts	Partner dashboard session required.	partners-api/src/routes/access.ts:268
GET	/api/partner-permissions	access.ts	Partner dashboard session required.	partners-api/src/routes/access.ts:188
PUT	/api/partner-permissions/members/:userId	access.ts	Partner dashboard session required.	partners-api/src/routes/access.ts:205
POST	/auth/accept-invite	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:953
POST	/auth/change-password	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:864
POST	/auth/dev-session	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:726
POST	/auth/exchange	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:832
GET	/auth/mfa/status	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:558
POST	/auth/mfa/totp/enroll	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:614
POST	/auth/mfa/totp/unenroll	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:688
POST	/auth/mfa/totp/verify	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:645
POST	/auth/otp/send	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:376
POST	/auth/otp/verify	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:417
POST	/auth/passkey/authentication/options	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:459
POST	/auth/passkey/authentication/verify	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:478
POST	/auth/passkey/registration/options	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:507
POST	/auth/passkey/registration/verify	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:528
POST	/auth/recovery-session	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1323
POST	/auth/refresh	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:785
POST	/auth/reset-password	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1289
POST	/auth/set-password	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1338
POST	/auth/sign-in	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:348
POST	/auth/sign-out	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:900
POST	/auth/sign-up	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1028
PUT	/auth/social/profile	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1209
GET	/auth/social/session	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1149
POST	/auth/social/sessions/revoke-others	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:931
POST	/auth/social/sign-up	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1059
POST	/hooks/send-email	authEmail.ts	Webhook/internal route; inspect signature or shared secret verification before use.	partners-api/src/routes/authEmail.ts:868

Endpoint contract notes

1. Action 1 - Verify unknowns: The table is source-generated, but fields marked unknown need manual handler review.
2. Action 2 - Check source line: Use the source line as the starting point for exact request, response, and side-effect behavior.
3. Action 3 - Review consumers: Search dashboard, rego, EMS LAN, and webhook callers before changing a path or response.
4. Action 4 - Update inventory: Regenerate after any route change.