Authentication API

Login Flows

GET /_matrix/client/v3/login

Returns available login flows:

{
  "flows": [
    { "type": "m.login.password" }
  ]
}

Password Login

POST /_matrix/client/v3/login
{
  "type": "m.login.password",
  "identifier": {
    "type": "m.id.user",
    "user": "alice"
  },
  "password": "secret123",
  "device_id": "MY_DEVICE",
  "initial_device_display_name": "Element Web"
}

Response:

{
  "user_id": "@alice:localhost",
  "access_token": "syt_xxx",
  "device_id": "ABCDEF",
  "home_server": "localhost"
}

Registration

POST /_matrix/client/v3/register

Uses UIAA (User-Interactive Authentication API):

Step 1 — Get flows:

// Response
{
  "flows": [
    { "stages": ["m.login.dummy"] }
  ],
  "params": {},
  "session": "abc123"
}

Step 2 — Complete registration:

{
  "username": "alice",
  "password": "secret123",
  "auth": {
    "type": "m.login.dummy",
    "session": "abc123"
  }
}

Response:

{
  "user_id": "@alice:localhost",
  "access_token": "syt_xxx",
  "device_id": "ABCDEF",
  "home_server": "localhost"
}

Check Username Availability

GET /_matrix/client/v3/register/available?username=alice
{ "available": true }

Token Refresh

POST /_matrix/client/v3/token/refresh
{
  "access_token": "syt_old",
  "refresh_token": "fyr_old"
}

Logout

POST /_matrix/client/v3/logout

Revokes the current device's access token.

POST /_matrix/client/v3/logout/all

Revokes all of the user's access tokens.

SSO Redirect (Stub)

GET /_matrix/client/v3/login/sso/redirect

Returns a stub response. SSO integration is not yet implemented.

Legacy Endpoints

EndpointControllerGate
POST /v1/login/get_tokenV1LoginController