Central Auth › Client API Reference
https://centralauth.serveo.net/api/v1
CLIENT API REFERENCE

Central Auth Platform

Complete API reference for Flutter, React, and other client applications. All endpoints accept and return application/json.

Base URL
https://centralauth.serveo.net
API Prefix
/api/v1
Content-Type
application/json
📋
All Endpoints
Method Endpoint Description Auth
POST /api/v1/identities/ Register a new account —
POST /api/v1/auth/login Login with email & password —
POST /api/v1/auth/otp/request Request OTP (login, reset, verify, link) —
POST /api/v1/auth/phone/verify OTP login via phone —
POST /api/v1/auth/google Google Sign-In token exchange —
POST /api/v1/auth/verify-email Verify email with OTP —
POST /api/v1/auth/resend-verification Resend email verification —
POST /api/v1/auth/forgot-password Request password reset —
POST /api/v1/auth/reset-password Reset password with OTP —
GET /api/v1/identities/me Get current user profile 🔒 Bearer
POST /api/v1/identities/me/phone Link phone number 🔒 Bearer
POST /api/v1/identities/me/email Link email address 🔒 Bearer
POST /api/v1/identities/me/password Update / set password 🔒 Bearer
DELETE /api/v1/identities/me Delete account (soft delete) 🔒 Bearer
POST /api/v1/auth/refresh Refresh tokens 🍪 Cookie
POST /api/v1/auth/logout Logout & revoke session —
GET /api/v1/auth/activities View login activities 🔒 Bearer
1
Registration
/api/v1/identities
POST /api/v1/identities/ Register a new account ▶
Request Body
JSON 
{
  "email": "[email protected]",
  "password": "SecurePassword123!",
  "clientId": "your_client_id"
}
201 Returns the created user identity object.
2
Authentication
/api/v1/auth
POST /api/v1/auth/login Login with email & password ▶
Request Body
JSON 
{
  "email": "[email protected]",
  "password": "SecurePassword123!",
  "clientId": "your_client_id"
}
200 Returns user info plus Access and Refresh Tokens.
POST /api/v1/auth/otp/request Request OTP (unified) ▶
ℹ
Unified OTP endpoint Supports types: LOGIN, RESET, VERIFY, LINK. Target can be email or phone number.
Request Body
JSON 
{
  "target": "[email protected]",  // OR "+1234567890"
  "type": "LOGIN"         // LOGIN | RESET | VERIFY | LINK
}
POST /api/v1/auth/phone/verify OTP login via phone ▶
Request Body
JSON 
{
  "target": "+1234567890",
  "code": "123456",
  "clientId": "your_client_id"
}
POST /api/v1/auth/google Google Sign-In token exchange ▶
ℹ
Google ID Token Exchange Exchanges a Google ID Token from the native Flutter/Android SDK for Central Auth tokens.
Request Body
JSON 
{
  "token": "eyJhbG... (Google ID Token)",
  "clientId": "your_client_id"
}
3
Verification & Recovery
/api/v1/auth
POST /api/v1/auth/verify-email Verify email with OTP ▶
JSON 
{ "email": "[email protected]", "otp": "123456" }
POST /api/v1/auth/resend-verification Resend verification email ▶
JSON 
{ "email": "[email protected]" }
POST /api/v1/auth/forgot-password Request password reset ▶
JSON 
{ "email": "[email protected]" }
POST /api/v1/auth/reset-password Reset password with OTP ▶
JSON 
{
  "email": "[email protected]",
  "otp": "123456",
  "newPassword": "NewPassword123!"
}
4
Protected Identity Management
/api/v1/identities/me
⚠
Authentication Required All endpoints in this section require: Authorization: Bearer <access_token>
GET /api/v1/identities/me Get current user profile ▶

No request body required. Pass the access token in the Authorization header.

200 Returns the current user's identity object.
POST /api/v1/identities/me/phone Link phone number ▶
⚠
Send an OTP first via /api/v1/auth/otp/request with type LINK before calling this endpoint.
JSON 
{
  "phone": "+1234567890",
  "code": "123456"
}
POST /api/v1/identities/me/email Link email address ▶
JSON 
{
  "email": "[email protected]",
  "code": "123456"
}
POST /api/v1/identities/me/password Update / set password ▶
JSON 
{
  "target": "[email protected]",
  "code": "123456",
  "newPassword": "NewPassword123!"
}
DELETE /api/v1/identities/me Delete account (soft delete) ▶

No request body required. This performs a soft delete — the account is marked as deleted but data is retained.

200 Account successfully soft-deleted.
5
Session Management
/api/v1/auth
POST /api/v1/auth/refresh Refresh tokens ▶
🍪
Cookie Required The refresh-token must be present as an httpOnly cookie. No request body needed.
200 Returns new access and refresh tokens.
POST /api/v1/auth/logout Logout & revoke session ▶

Revokes the current session and clears authentication cookies. No request body required.

GET /api/v1/auth/activities View login activities ▶
Required Header
HTTP 
Authorization: Bearer <access_token>
200 Returns login history for the current user.
🔄
Authentication Flow Guide
📧 Email / Password
1
Register via POST /identities/
2
Verify email via POST /auth/verify-email
3
Login via POST /auth/login → receive tokens
4
Use Authorization: Bearer <token> on protected routes
📱 OTP Phone Login
1
Request OTP via POST /auth/otp/request with type LOGIN
2
Verify OTP via POST /auth/phone/verify → receive tokens
🔵 Google Sign-In
1
Get Google ID Token from Flutter/Android SDK
2
Exchange via POST /auth/google → receive Central Auth tokens
🔁 Token Refresh
1
Access token expires
2
Call POST /auth/refresh — refresh token sent automatically via httpOnly cookie
3
Receive new access + refresh tokens
Central Auth Platform — Client API Reference  ·  All endpoints return application/json