> For the complete documentation index, see [llms.txt](https://timechain.gitbook.io/neucron/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://timechain.gitbook.io/neucron/api-references/authentication.md).

# Authentication

Entry point to Neucron. Every protected call needs a valid session token.

* **Email + password** — classic login, returns a bearer token
* **Phone OTP** — passwordless SMS verification
* **OAuth SSO** — Google / Microsoft
* **Passkeys** — WebAuthn biometric / hardware-key login & MFA
* **Sessions** — list and revoke devices

> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests.

## Signup

> Register a new Neucron user account with email, password, and phone.\
> \
> Creates a personal (or business-flagged) user. On success, returns an access token so the client can continue onboarding without a separate login. Optional \`referral\_code\` attributes the signup to a referrer.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/auth/signup":{"post":{"tags":["Authentication"],"summary":"Signup","description":"Register a new Neucron user account with email, password, and phone.\n\nCreates a personal (or business-flagged) user. On success, returns an access token so the client can continue onboarding without a separate login. Optional `referral_code` attributes the signup to a referrer.","operationId":"authentication_signup","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"token":{"type":"string","description":"Access token (may also appear as `access_token` or `data.access_token`)."}}}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-App-ID","in":"header","required":false,"description":"Application identifier.","schema":{"type":"string"}},{"name":"X-Neucron-Key-ID","in":"header","required":false,"description":"API key identifier.","schema":{"type":"string"}},{"name":"X-Neucron-Key-Secret","in":"header","required":false,"description":"API key secret.","schema":{"type":"string"}},{"name":"X-Neucron-User-ID","in":"header","required":false,"description":"Authenticated user identifier.","schema":{"type":"string"}}],"requestBody":{"required":true,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","description":"User email address."},"password":{"type":"string","description":"Account password."},"country_code":{"type":"string","description":"Phone country code (e.g. `+91`)."},"phone_number":{"type":"string","description":"Phone number without country code."},"platform":{"type":"string","description":"Client platform identifier (e.g. `NEUCRON`)."},"is_business":{"type":"boolean","description":"Whether the account is registering as a business."},"referral_code":{"type":"string","description":"Optional referral code."}},"required":["email","password","country_code","phone_number","platform","is_business"]}}}}}}}}
```

## Login

> Authenticate with email and password and receive a session token.\
> \
> Validates credentials and returns a token used for all authenticated API calls. Store the token securely (e.g. local storage / secure cookie) and attach it on every request.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/auth/login":{"post":{"tags":["Authentication"],"summary":"Login","description":"Authenticate with email and password and receive a session token.\n\nValidates credentials and returns a token used for all authenticated API calls. Store the token securely (e.g. local storage / secure cookie) and attach it on every request.","operationId":"authentication_login","responses":{"200":{"description":"200 OK — Login successful; token returned.","content":{"application/json":{"schema":{"type":"object","properties":{"token":{"type":"string","description":"Session access token."}}}}}},"302":{"description":"302 Found — Redirect (if SSO/cookie flow applies)."},"400":{"description":"400 Bad Request — Malformed body."},"401":{"description":"401 Unauthorized — Invalid credentials."},"409":{"description":"409 Conflict — Account state conflict."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"X-Identifier","in":"header","required":true,"description":"Use `NEUCRON`.","schema":{"type":"string"}}],"requestBody":{"required":true,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","description":"Registered email address."},"password":{"type":"string","description":"Account password."}},"required":["email","password"]}}}}}}}}
```

## Logout

> Invalidate the current session on the server.\
> \
> Ends the authenticated session. Clients should also clear locally stored tokens and business context.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/auth/logout":{"post":{"tags":["Authentication"],"summary":"Logout","description":"Invalidate the current session on the server.\n\nEnds the authenticated session. Clients should also clear locally stored tokens and business context.","operationId":"authentication_logout","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":false,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}}}
```

## Get Sessions

> List active (and optionally revoked) sessions for the current user.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/auth/sessions":{"get":{"tags":["Authentication"],"summary":"Get Sessions","description":"List active (and optionally revoked) sessions for the current user.","operationId":"authentication_get_sessions","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"includeRevoke","in":"query","required":false,"description":"Include revoked sessions when `true`.","schema":{"type":"boolean"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}]}}}}
```

## Revoke Session

> Revoke one or more sessions by ID.\
> \
> Useful for remote logout when a device is lost or a suspicious session appears.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/auth/session/revoke":{"post":{"tags":["Authentication"],"summary":"Revoke Session","description":"Revoke one or more sessions by ID.\n\nUseful for remote logout when a device is lost or a suspicious session appears.","operationId":"authentication_revoke_session","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":true,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"array","items":{"type":"string"},"description":"Array of session IDs to revoke."}}}}}}}}
```

## Forgot Password

> Send a password-reset email to the user.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/auth/password/forgot":{"post":{"tags":["Authentication"],"summary":"Forgot Password","description":"Send a password-reset email to the user.","operationId":"authentication_forgot_password","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"email","in":"query","required":true,"description":"Account email.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":false,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}}}
```

## Reset Password

> Set a new password using the token from the reset email.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/auth/password/reset":{"put":{"tags":["Authentication"],"summary":"Reset Password","description":"Set a new password using the token from the reset email.","operationId":"authentication_reset_password","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":true,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","properties":{"token":{"type":"string","description":"Reset token from email link."},"new_password":{"type":"string","description":"New password."}},"required":["token","new_password"]}}}}}}}}
```

## Update Password

> Change password for an authenticated user (requires old password).

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/auth/user/password":{"put":{"tags":["Authentication"],"summary":"Update Password","description":"Change password for an authenticated user (requires old password).","operationId":"authentication_update_password","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":true,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","properties":{"old_password":{"type":"string","description":"Current password."},"new_password":{"type":"string","description":"New password."}},"required":["old_password","new_password"]}}}}}}}}
```

## Get User Info

> Fetch the authenticated user's profile.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/auth/user/info":{"get":{"tags":["Authentication"],"summary":"Get User Info","description":"Fetch the authenticated user's profile.","operationId":"authentication_get_user_info","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}]}}}}
```

## Send Email Verification

> Send an email verification link/OTP to the given address.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/auth/email/send":{"post":{"tags":["Authentication"],"summary":"Send Email Verification","description":"Send an email verification link/OTP to the given address.","operationId":"authentication_send_email_verification","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"email","in":"query","required":true,"description":"Email to verify.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":false,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}}}
```

## Verify User Email

> Confirm email ownership using token and verification code from the email link.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/auth/email/verify":{"put":{"tags":["Authentication"],"summary":"Verify User Email","description":"Confirm email ownership using token and verification code from the email link.","operationId":"authentication_verify_user_email","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"token","in":"query","required":true,"description":"Verification token.","schema":{"type":"string"}},{"name":"verifyCode","in":"query","required":true,"description":"Verification code.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":false,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}}}
```

## Send Signup Email OTP

> Send a signup email OTP (\`otpType=VERIFY\_EMAIL\`).

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/auth/email/otp/send":{"post":{"tags":["Authentication"],"summary":"Send Signup Email OTP","description":"Send a signup email OTP (`otpType=VERIFY_EMAIL`).","operationId":"authentication_send_signup_email_otp","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"email","in":"query","required":true,"description":"Signup email.","schema":{"type":"string"}},{"name":"otpType","in":"query","required":true,"description":"Use `VERIFY_EMAIL`.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":false,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}}}
```

## Confirm Signup Email OTP

> Confirm signup email with the OTP received.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/auth/email/otp/confirm":{"post":{"tags":["Authentication"],"summary":"Confirm Signup Email OTP","description":"Confirm signup email with the OTP received.","operationId":"authentication_confirm_signup_email_otp","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":true,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","description":"Email being verified."},"otp":{"type":"string","description":"One-time password."},"otp_type":{"type":"string","description":"OTP type (e.g. `VERIFY_EMAIL`)."}},"required":["email","otp"]}}}}}}}}
```

## OAuth Redirect

> Get the OAuth provider redirect URL (Google / Microsoft).

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/auth/oauth/redirect":{"get":{"tags":["Authentication"],"summary":"OAuth Redirect","description":"Get the OAuth provider redirect URL (Google / Microsoft).","operationId":"authentication_oauth_redirect","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"type","in":"query","required":true,"description":"Provider type (e.g. `google`, `microsoft`).","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}]}}}}
```

## OAuth Callback

> Exchange OAuth \`code\` and \`state\` for a Neucron session token.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/auth/oauth/callback":{"post":{"tags":["Authentication"],"summary":"OAuth Callback","description":"Exchange OAuth `code` and `state` for a Neucron session token.","operationId":"authentication_oauth_callback","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"code","in":"query","required":true,"description":"OAuth authorization code.","schema":{"type":"string"}},{"name":"state","in":"query","required":true,"description":"OAuth state parameter.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}]}}}}
```

## Check Phone Exists

> Check whether a phone number is already registered.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/auth/phone/exists":{"post":{"tags":["Authentication"],"summary":"Check Phone Exists","description":"Check whether a phone number is already registered.","operationId":"authentication_check_phone_exists","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"countryCode","in":"query","required":true,"description":"Country code.","schema":{"type":"string"}},{"name":"phoneNumber","in":"query","required":true,"description":"Phone number.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":false,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}}}
```

## Send Phone OTP

> Send an OTP SMS to the phone number for verification/login.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/auth/phone/login":{"post":{"tags":["Authentication"],"summary":"Send Phone OTP","description":"Send an OTP SMS to the phone number for verification/login.","operationId":"authentication_send_phone_otp","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"countryCode","in":"query","required":true,"description":"Country code.","schema":{"type":"string"}},{"name":"phoneNumber","in":"query","required":true,"description":"Phone number.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":false,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}}}
```

## Verify Phone OTP

> Verify the phone OTP and complete phone authentication.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/auth/otp/verify":{"post":{"tags":["Authentication"],"summary":"Verify Phone OTP","description":"Verify the phone OTP and complete phone authentication.","operationId":"authentication_verify_phone_otp","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"countryCode","in":"query","required":true,"description":"Country code.","schema":{"type":"string"}},{"name":"phoneNumber","in":"query","required":true,"description":"Phone number.","schema":{"type":"string"}},{"name":"otp","in":"query","required":true,"description":"OTP code.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}]}}}}
```

## Check Username

> Check if a Neucron username/handle is already taken.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/handle/check":{"get":{"tags":["Authentication"],"summary":"Check Username","description":"Check if a Neucron username/handle is already taken.","operationId":"authentication_check_username","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"taken":{"type":"boolean","description":"`true` if username is unavailable."}},"required":["taken"]}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"username","in":"query","required":true,"description":"Desired username.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}]}}}}
```

## Passkey Register Start

> Begin WebAuthn passkey registration (authenticated). Returns a challenge for the authenticator.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/passkey/registerStart":{"post":{"tags":["Authentication"],"summary":"Passkey Register Start","description":"Begin WebAuthn passkey registration (authenticated). Returns a challenge for the authenticator.","operationId":"authentication_passkey_register_start","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":false,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}}}
```

## Passkey Register Finish

> Complete passkey registration by submitting the WebAuthn attestation response.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Access token from `POST /auth/login` or `POST /auth/signup`. Also send header `X-Identifier: NEUCRON`. For business APIs, include `X-Neucron-Business-ID`."}}},"paths":{"/passkey/registerFinish":{"post":{"tags":["Authentication"],"summary":"Passkey Register Finish","description":"Complete passkey registration by submitting the WebAuthn attestation response.","operationId":"authentication_passkey_register_finish","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":true,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","properties":{"WebAuthn credential":{"type":"object","additionalProperties":true,"description":"Browser WebAuthn registration result."}},"required":["WebAuthn credential"]}}}}}}}}
```

## Passkey Verify Start

> Begin passkey login / MFA. Returns an assertion challenge.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/passkey/verifyStart":{"post":{"tags":["Authentication"],"summary":"Passkey Verify Start","description":"Begin passkey login / MFA. Returns an assertion challenge.","operationId":"authentication_passkey_verify_start","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":true,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","description":"Email for login ceremony (optional for MFA)."}}}}}}}}}}
```

## Passkey Verify Finish

> Complete passkey verification. On login, returns an access token.

```json
{"openapi":"3.0.3","info":{"title":"Neucron API Documentation","version":"1.0.0"},"tags":[{"name":"Authentication","description":"Entry point to Neucron. Every protected call needs a valid session token.\n\n- **Email + password** — classic login, returns a bearer token\n- **Phone OTP** — passwordless SMS verification\n- **OAuth SSO** — Google / Microsoft\n- **Passkeys** — WebAuthn biometric / hardware-key login & MFA\n- **Sessions** — list and revoke devices\n\n> Send `Authorization` and `X-Identifier: NEUCRON` on authenticated requests."}],"servers":[{"url":"https://dev.neucron.io","description":"Development"},{"url":"https://api.neucron.io","description":"Production"}],"security":[],"paths":{"/passkey/verifyFinish":{"post":{"tags":["Authentication"],"summary":"Passkey Verify Finish","description":"Complete passkey verification. On login, returns an access token.","operationId":"authentication_passkey_verify_finish","responses":{"200":{"description":"200 OK — Request completed successfully.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400 Bad Request — Invalid or missing parameters."},"401":{"description":"401 Unauthorized — Missing or invalid authentication."},"403":{"description":"403 Forbidden — Insufficient permissions."},"404":{"description":"404 Not Found — Resource does not exist."},"409":{"description":"409 Conflict — Resource conflict (e.g. duplicate)."},"500":{"description":"500 Internal Server Error — Server-side failure."}},"parameters":[{"name":"requestID","in":"query","required":true,"description":"Request ID from verifyStart.","schema":{"type":"string"}},{"name":"X-Identifier","in":"header","required":true,"description":"Platform identifier. Use `NEUCRON`.","schema":{"type":"string"}},{"name":"X-Neucron-Business-ID","in":"header","required":false,"description":"Active business context. Required for business-scoped operations.","schema":{"type":"string"}}],"requestBody":{"required":true,"description":"Request body (`application/json`)","content":{"application/json":{"schema":{"type":"object","properties":{"WebAuthn assertion":{"type":"object","additionalProperties":true,"description":"Browser WebAuthn assertion result."}},"required":["WebAuthn assertion"]}}}}}}}}
```