Authentication

Create a new user account and send a verification email. The account is created even if the email can't be sent; the user can ask for another one with Resend Verification Email.

Authenticate with email and password. Returns an access token and sets a session cookie.

Refresh the current session. Reads the session token from the X-Session-Token header, or from the duvet_session_token cookie when there's no header. Returns a new access token and rotates the session token. Refreshes of one session that overlap all get the same new tokens: for 30 seconds after a rotation, the previous session token refreshes to the current tokens. After that, or once the session is logged out, it answers 401. The new tokens last 24 hours, but a session ends 30 days after its login: from then on, refreshing it answers 401 and the user has to log in again.

Revoke the current session token (from the X-Session-Token header, or else the cookie) and clear the session cookie.

Verify a user's email address using a one-time token sent via email.

Send a new email verification token to the authenticated user. Requires authentication. At most 3 per hour per account.

Reset a password using a password reset token.

Send a password reset email to the authenticated user. Requires authentication. At most 3 per hour per account.

Request a password reset email by providing an email address. Always returns success to avoid revealing whether the email exists. Sends at most 3 emails per address per hour; requests past that still succeed but send nothing.

Update the user's email address using a verification token and the new email.

Send a verification email to initiate an email address change. Requires authentication. At most 3 per hour per account.