Authentication and authorization domain: user lifecycle, credentials, sessions/tokens, and MFA flows.
| Namespace | Purpose |
|---|---|
| Pure user-domain business logic |
| Pure MFA setup/verification logic |
| Service-layer orchestration and validation |
| Auth/user HTTP handlers |
# Login
curl -X POST http://localhost:3000/api/v1/auth/login \
-H "Content-Type: application/json" \
-d '{"email": "user@example.com", "password": "secret"}'
# Create a user (admin)
curl -X POST http://localhost:3000/api/v1/users \
-H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
-d '{"email": "new@example.com", "password": "secret", "name": "Alice", "role": "user"}'Anyone can create their own account at /web/register unless :wagoe/user
sets :registration false.
# 1. Start MFA setup
curl -X POST http://localhost:3000/api/v1/auth/mfa/setup \
-H "Authorization: Bearer <token>"
# 2. Enable MFA (verify with TOTP code)
curl -X POST http://localhost:3000/api/v1/auth/mfa/enable \
-H "Authorization: Bearer <token>" \
-d '{"secret": "...", "backupCodes": ["..."], "verificationCode": "123456"}'
# 3. Login with MFA
curl -X POST http://localhost:3000/api/v1/auth/login \
-d '{"email": "user@example.com", "password": "...", "mfaCode": "123456"}'
# Disable MFA
curl -X POST http://localhost:3000/api/v1/auth/mfa/disable \
-H "Authorization: Bearer <token>" \
-d '{"code": "123456"}'# Create a session (sign in)
curl -X POST http://localhost:3000/api/v1/sessions \
-d '{"email": "user@example.com", "password": "..."}'
# Validate a session token
curl http://localhost:3000/api/v1/sessions/{token}
# Invalidate it (sign out)
curl -X DELETE http://localhost:3000/api/v1/sessions/{token}Admins list and revoke a user’s sessions in the web UI at /web/users/:id/sessions.
A signed-in user downloads what the framework holds about them as JSON: profile, sessions, sign-in links, groups and the audit entries naming them. No password hash or MFA secret is included.
curl http://localhost:3000/api/v1/me/export -H "Authorization: Bearer <token>"Platform admins (outside any tenant) export any user at GET /api/v1/users/:id/export; each such export is
recorded in the user’s audit log as :data-export. With the storage and jobs
modules, POST /api/v1/users/:id/export-jobs builds it as a background job; see
storage. The audit log can expire
through the :user/audit-log retention policy; see
data export and retention.
JWT_SECRET must be set (minimum 32 characters)
Internal keys use :password-hash (kebab-case), never :password_hash
Account lockout is enforced after repeated failed logins
:wagoe/settings {:features {:user-web-ui {:enabled? false}}} (WAG_WEB_UI_ENABLED=false) drops the HTML pages for an API-only deployment; see what it removes
JWT_SECRET="dev-secret-at-least-32-characters-long" clojure -M:test :user
# Update validation snapshots
UPDATE_SNAPSHOTS=true clojure -M:test :user \
--focus user-validation-snapshot-testCan you improve this documentation? These fine people already did:
thijscreemers & Thijs CreemersEdit on GitHub
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |