Skip to content
Authrim

Create or resume a human guest browser session.

POST
/api/auth/guest/login
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/api/auth/guest/login \
  --header 'Content-Type: application/json' \
  --data '{ "clientId": "example", "authorizationChallengeId": "example", "human_verification_response": "example" }'

Requires tenant guest login permission and explicit client guest permission. For OAuth login, supply an unexpired, unconsumed login authorization challenge for this tenant; requested scopes must be within the client’s anonymous allow-list. Reauthentication challenges are rejected. For direct browser login, omit the challenge and supply clientId. The client must permit browser Direct Auth from the request origin and allow the openid guest scope. Direct login creates only a cookie session, not an OAuth grant. An invalid supplied challenge never falls back to direct login. Subject creation and resumption use a private HttpOnly Secure SameSite=Lax cookie, authrim_guest_resume; a device identifier alone is never accepted as proof. Resume credentials expire 180 days after creation without deleting the account. A live registered browser session must be logged out first (409). Success sets authrim_session and returns no tokens or redirect URL; continue the original authorization transaction through the standard login continuation when using a challenge. Requests are subject to browser CSRF protection, configured login human verification, and strict rate limiting. Human verification is bound to this login transaction and private resume credential for up to five minutes to permit asynchronous provisioning retries.

Request Body required

Section titled “Request Body required ”
Media type application/json
Any of:
object
clientId

Client for direct browser login; ignored when an authorization challenge is supplied.

string
>= 1 characters <= 256 characters
authorizationChallengeId
required
string
>= 1 characters <= 256 characters
human_verification_response

Token from the configured login human-verification provider.

string
Example generated
{
  "clientId": "example",
  "authorizationChallengeId": "example",
  "human_verification_response": "example"
}

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Guest browser session established.

Media type application/json
object
success
required
boolean
Example 
{
  "success": true
}

202

Section titled “202 ”

Anonymous account routing is being created or an expired route is being released.

Media type application/json
One of:
object
status
required
string
Allowed value: provisioning
provisioning_token
required
string
/^[A-Za-z0-9_-]{43}$/
status_endpoint
required
string
Allowed value: /api/v1/auth/account-provisioning/status
retry_after_ms
required
integer
>= 250 <= 2000
expires_in
required
integer
>= 1 <= 600
resume_user_id

Present for passkey signup only. The Login UI sends this continuation value back with the provisioning token so a retried request reuses the same account candidate.

string
key
additional properties
Example 
{
  "status": "provisioning",
  "status_endpoint": "/api/v1/auth/account-provisioning/status"
}

400

Section titled “400 ”

Invalid challenge, disabled guest login, or disallowed guest scopes.

401

Section titled “401 ”

Resume credential expired or revoked, or account no longer eligible.

409

Section titled “409 ”

A registered browser session already exists; log out before creating a guest.

429

Section titled “429 ”

Too many login attempts.

500

Section titled “500 ”

Guest account storage or settings are temporarily unavailable.