Public configuration of the sign-in and sign-up forms

GET

/auth/config

const url = 'https://api.flotera.com/api/v1/auth/config';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://api.flotera.com/api/v1/auth/config

Unauthenticated endpoint that tells the panel how to render the auth forms: whether public signup is open on this deployment and whether a Cloudflare Turnstile challenge must be solved (plus the widget’s public sitekey).

It is deliberately a separate public operation rather than a field on GET /auth/me: the sitekey is needed before a session exists, and /auth/me is session-only. The response depends only on deployment configuration, never on the request, and carries no secret — the Turnstile sitekey is public by design and signup_enabled is observable by calling /auth/signup/start anyway.

sitekey is non-null only when enabled is true: a widget the server does not verify must not be shown.

Responses

200

Auth form configuration.

application/json

object

api_version

required

Exact API binary build version.

string

<= 64 characters /^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/

signup_enabled

required

Whether the POST /auth/signup/* operations accept requests on this deployment. False means they answer 404 for every payload. Password reset is not gated by this flag.

boolean

turnstile

required

object

enabled

required

Whether the server verifies turnstile_token on the public auth operations. False means no challenge is required.

boolean

sitekey

required

Public Cloudflare Turnstile sitekey for the widget. Non-null only when enabled is true.

string | null

<= 64 characters

Example

{
  "turnstile": {
    "sitekey": "0x4AAAAAAD7drVZhtRaeHpsV"
  }
}