API reference
All paths in this reference are relative to https://auth.sigmaidentity.com. Use the live OIDC discovery and OpenAPI schema for Better Auth protocol shapes. OpenAPI paths are relative to /api/auth; they do not enumerate all custom Next.js APIs.
OAuth and OIDC
| Endpoint | Method | Purpose |
|---|---|---|
/api/auth/oauth2/authorize | GET | Authorization request; browser session/consent flow |
/oauth2/authorize | GET | Sigma browser entry page that validates/forwards authorization |
/api/auth/oauth2/token | POST | Form-encoded token exchange or refresh |
/api/auth/oauth2/userinfo | GET, POST | User claims with OAuth bearer access token |
/api/auth/jwks | GET | Public signing keys |
/api/auth/oauth2/register | POST | Dynamic Client Registration, subject to issuer policy |
/api/auth/oauth2/introspect | POST | Token introspection |
/api/auth/oauth2/revoke | POST | Token revocation |
/api/auth/oauth2/end-session | GET | OIDC logout flow |
Sigma's hook additionally requires Bitcoin X-Auth-Token client authentication for authorization-code and refresh exchanges. DCR does not automatically assign that signing key. See client registration, PKCE, and tokens.
Account and identity APIs
| Surface | Authentication | Guide |
|---|---|---|
/api/auth/get-session, /api/auth/sign-out | Better Auth session | Account |
/api/user/bap-ids | Session; public lookup with explicit pubkey on GET | Profile API |
/api/bap/profile | Public GET; session-scoped draft mutations | BAP profiles |
/api/oauth-clients | Public metadata GET; owned-session management | OAuth clients |
/api/backup, /api/backup/status, /api/backup/link-oauth, /api/backup/sync | Different per route | Backup API |
/api/wallet/* | Better Auth session and profile ownership where required | Wallet API |
/api/domain-verifications | Owned Better Auth session | Wallet credentials |
Devices, agents, and wallets
| Surface | Guide |
|---|---|
/api/auth/device/* and /device | Device authorization |
/api/auth/agent/* and agent discovery | Agents |
/api/organizations/{bapId}/delegations | Teams and delegations |
/api/certificates/* | Wallet credentials |
/api/brc169/handles/*, /.well-known/metanet-handles/*, /api/messagebox/* | Handles and messageboxes |
/signer | Browser signing |
An OAuth bearer token does not authorize every route in this table. BRC-103/104 wallet authentication is a separate transport, and a Bitcoin auth header is accepted only where implemented. Admin, setup, internal callback, cron, and image-generation routes support the first-party application; their existence is not a stable public integration promise.
Response handling
Use HTTP status and documented response fields. Handle missing optional profile data and gated 503 responses. See errors and rate limits. Never send user private keys, decrypted backups, or backup passwords to these APIs.