# Prelude Docs

- [Welcome to Prelude Docs](https://docs.prelude.so/introduction/welcome-to-prelude.md): Prelude is the authentication infrastructure for developer teams, built on telco intelligence to verify users via phone or email, prevent fraud, and manage authentication across 230+ countries.
- [Introduction to the Frontend SDKs](https://docs.prelude.so/introduction/frontend-sdks/introduction.md): Learn how to use our Frontend SDKs
- [Web SDK](https://docs.prelude.so/introduction/frontend-sdks/web.md): Learn how to capture frontend browser signals to integrate them with the verification backend APIs. It allows you to capture certain browser signals that will be reported back to your Prelude account.
- [Apple SDK](https://docs.prelude.so/introduction/frontend-sdks/apple.md): Learn how to use our client side Apple SDK.
- [Android SDK](https://docs.prelude.so/introduction/frontend-sdks/android.md): Learn how to use our client side Android SDK.
- [React Native SDK](https://docs.prelude.so/introduction/frontend-sdks/react-native.md): Learn how to use our client side Expo React Native SDK.
- [Flutter SDK](https://docs.prelude.so/introduction/frontend-sdks/flutter.md): Learn how to use our client side Flutter SDK.
- [Node.js](https://docs.prelude.so/introduction/backend-sdks/node.md)
- [Go](https://docs.prelude.so/introduction/backend-sdks/go.md)
- [Python](https://docs.prelude.so/introduction/backend-sdks/python.md)
- [Kotlin/Java](https://docs.prelude.so/introduction/backend-sdks/java.md)
- [Ruby](https://docs.prelude.so/introduction/backend-sdks/ruby.md)
- [PHP](https://docs.prelude.so/introduction/backend-sdks/php.md)
- [C#](https://docs.prelude.so/introduction/backend-sdks/csharp.md)
- [Changelog](https://docs.prelude.so/introduction/changelog.md): Changes made to the Prelude platform.
- [GitHub](https://docs.prelude.so/introduction/github.md)
- [Introduction to Verify](https://docs.prelude.so/verify/v2/documentation/introduction.md): Verify phone numbers and emails worldwide using the most appropriate channel depending on your user's context.
- [Quickstart](https://docs.prelude.so/verify/v2/documentation/quickstart.md): Send and verify a code in 2 minutes and 3 simple steps with our SDKs, available for Node.js, Python, and Go.
- [Verification Lifecycle](https://docs.prelude.so/verify/v2/documentation/lifecycle.md): Understand the verification lifecycle and how it allows you to build a fully-functional verification flow in your application.
- [Prevent Fraud](https://docs.prelude.so/verify/v2/documentation/prevent-fraud.md): Configure your integration to protect your application against fraud like SMS pumping or IRSF fraud with Prelude's machine learning models.
- [Message Content](https://docs.prelude.so/verify/v2/documentation/content.md): Learn the various customization options for your verification messages.
- [Custom Sender IDs](https://docs.prelude.so/verify/v2/documentation/sender-id.md): Send verification messages through your branded sender ID.
- [Connect your WhatsApp Business Account to Prelude](https://docs.prelude.so/verify/v2/documentation/whatsapp.md): Learn how to connect your WhatsApp Business Account to Prelude via Meta's Embedded Signup so you can send verification messages from your branded WhatsApp number.
- [Webhook for the Verify API](https://docs.prelude.so/verify/v2/documentation/webhook.md): Prelude Verify API can notify your application about events using webhooks. Get notified when your messages are delivered and billed.
- [Test Numbers](https://docs.prelude.so/verify/v2/documentation/testing.md): Learn how to confirm that your integration is working properly by simulating verifications without incurring charges using special test numbers.
- [Silent Verification](https://docs.prelude.so/verify/v2/documentation/silent-verification.md): Allow your users to onboard faster without the need for manually entering a verification code.
- [Email Verification](https://docs.prelude.so/verify/v2/documentation/email-verification.md): Use the Verify API to verify email addresses.
- [Migrate from V1](https://docs.prelude.so/verify/v2/documentation/v2-migration-guide.md): A guide to help you migrate from V1 to V2 of the Verify API.
- [Prelude API v2 and Firebase Auth integration](https://docs.prelude.so/verify/v2/documentation/integrations/firebase.md)
- [Integrate Prelude with Supabase phone authentication](https://docs.prelude.so/verify/v2/documentation/integrations/supabase.md): Replace Supabase's default SMS provider with Prelude to raise phone-authentication delivery rates and cut cost.
- [Integrate Prelude with Auth0 for phone verification](https://docs.prelude.so/verify/v2/documentation/integrations/auth0.md): Replace Auth0's default SMS provider with Prelude to raise verification delivery rates and cut cost.
- [Create or retry a verification](https://docs.prelude.so/verify/v2/api-reference/create-or-retry-a-verification.md): Create a new verification for a specific phone number. If another non-expired verification exists (the request is performed within the verification window), this endpoint will perform a retry instead.
- [Check a code](https://docs.prelude.so/verify/v2/api-reference/check-a-code.md): Check the validity of a verification code.
- [Overview](https://docs.prelude.so/verify/v2/api-reference/management/overview.md): Programmatically manage sender IDs, allow lists, and block lists for the Verify API.
- [List available Sender IDs](https://docs.prelude.so/verify/v2/api-reference/management/sender-id/list-sender-ids.md): Retrieve sender IDs list.
- [Submit a sender ID](https://docs.prelude.so/verify/v2/api-reference/management/sender-id/submit-sender-id.md): This endpoint allows you to submit a new sender ID for verification purposes.
- [Get phone numbers allow or block list](https://docs.prelude.so/verify/v2/api-reference/management/phone-numbers/get-phone-numbers.md): Retrieve the list of phone numbers in the allow or block list.
- [Add phone number to allow or block list](https://docs.prelude.so/verify/v2/api-reference/management/phone-numbers/add-phone-number.md): Add a phone number to the allow or block list.
- [Delete phone number from allow or block list](https://docs.prelude.so/verify/v2/api-reference/management/phone-numbers/delete-phone-number.md): Remove a phone number from the allow or block list.
- [Get sandbox phone numbers](https://docs.prelude.so/verify/v2/api-reference/management/phone-numbers/sandbox/get-sandbox-phone-numbers.md): Retrieve the list of sandbox phone numbers for the account. Sandbox numbers are test numbers that bypass the real verification flow and return a fixed attempt code.
- [Add a sandbox phone number](https://docs.prelude.so/verify/v2/api-reference/management/phone-numbers/sandbox/add-sandbox-phone-number.md): Register a phone number as a sandbox number and associate it with a fixed attempt code. Subsequent verification attempts against this number will not trigger a real SMS/call and will validate against the configured attempt code.
- [Delete a sandbox phone number](https://docs.prelude.so/verify/v2/api-reference/management/phone-numbers/sandbox/delete-sandbox-phone-number.md): Remove a phone number from the sandbox list.
- [Introduction to the V1 API (Legacy)](https://docs.prelude.so/verify/v1/documentation/introduction.md): This page refers to our Legacy API, V1.
- [Webhook](https://docs.prelude.so/verify/v1/documentation/webhook.md): Learn how to easily register a webhook with Prelude to get notified when your messages are delivered and billed.
- [Troubleshooting errors (V1 API)](https://docs.prelude.so/verify/v1/documentation/errors.md): This page presents how to handle errors with our Legacy API, V1.
- [Send a code (V1 API)](https://docs.prelude.so/verify/v1/api-reference/send-a-code.md): This page presents how to send a code with our Legacy API, V1.
- [Check a code (V1 API)](https://docs.prelude.so/verify/v1/api-reference/check-a-code.md): This page presents how to check a code with our Legacy API, V1.
- [Perform a retry (V1 API)](https://docs.prelude.so/verify/v1/api-reference/perform-a-retry.md): This page presents how to perform a retry with our Legacy API, V1.
- [Introduction to Auth](https://docs.prelude.so/auth/documentation/introduction.md): Manage the full lifecycle of your users' authentication.
- [Integration Guide](https://docs.prelude.so/auth/documentation/integration-guide/introduction.md): Step-by-step guides to integrate Prelude Auth into your application.
- [OTP Login](https://docs.prelude.so/auth/documentation/integration-guide/otp-login.md): Configure OTP-based authentication with Prelude Auth using phone or email.
- [Password Authentication](https://docs.prelude.so/auth/documentation/integration-guide/password-authentication.md): Configure email and password authentication with Prelude Auth.
- [Passkey Authentication](https://docs.prelude.so/auth/documentation/integration-guide/passkey.md): Configure WebAuthn passkey authentication for MFA step-up or passwordless sign-in.
- [MCP Login](https://docs.prelude.so/auth/documentation/integration-guide/mcp.md): Let MCP clients sign your users in by configuring Prelude Auth as the OAuth 2.0 authorization server for your MCP server.
- [SSO Login](https://docs.prelude.so/auth/documentation/integration-guide/sso.md): Add single sign-on across your own applications by using Prelude Auth as the OAuth 2.0 authorization server, then sign clients in with the Web SDK.
- [Introduction](https://docs.prelude.so/auth/documentation/integration-guide/social-login/introduction.md): Configure social login providers for your Auth application.
- [Google](https://docs.prelude.so/auth/documentation/integration-guide/social-login/google.md): Configure Google OAuth for your Auth application.
- [Apple](https://docs.prelude.so/auth/documentation/integration-guide/social-login/apple.md): Configure Apple OAuth for your Auth application.
- [Microsoft](https://docs.prelude.so/auth/documentation/integration-guide/social-login/microsoft.md): Configure Microsoft OAuth for your Auth application.
- [GitHub](https://docs.prelude.so/auth/documentation/integration-guide/social-login/github.md): Configure GitHub OAuth for your Auth application.
- [Okta](https://docs.prelude.so/auth/documentation/integration-guide/social-login/okta.md): Configure Okta OAuth for your Auth application.
- [Facebook](https://docs.prelude.so/auth/documentation/integration-guide/social-login/facebook.md): Configure Facebook OAuth for your Auth application.
- [LinkedIn](https://docs.prelude.so/auth/documentation/integration-guide/social-login/linkedin.md): Configure LinkedIn OAuth for your Auth application.
- [Introduction](https://docs.prelude.so/auth/documentation/integration-guide/saml/introduction.md): Configure SAML 2.0 single sign-on (SSO) for your Auth application.
- [Okta](https://docs.prelude.so/auth/documentation/integration-guide/saml/okta.md): Configure an Okta SAML application for your Auth application.
- [Google Workspace](https://docs.prelude.so/auth/documentation/integration-guide/saml/google.md): Configure a Google Workspace custom SAML app for your Auth application.
- [JumpCloud](https://docs.prelude.so/auth/documentation/integration-guide/saml/jumpcloud.md): Configure a JumpCloud SAML application for your Auth application.
- [Enforce SSO login](https://docs.prelude.so/auth/documentation/integration-guide/saml/enforce.md): Require allowlisted email domains to authenticate through SAML SSO.
- [Introduction](https://docs.prelude.so/auth/documentation/integration-guide/enterprise-oidc/introduction.md): Configure enterprise single sign-on (SSO) over OpenID Connect for your Auth application.
- [Step-Up Authentication](https://docs.prelude.so/auth/documentation/step-up-authentication.md): Add scoped, multi-step authentication challenges to existing sessions.
- [Custom Steps](https://docs.prelude.so/auth/documentation/step-up-custom-steps.md): Add client-owned verification steps to step-up challenges.
- [Step-Up Hook Reference](https://docs.prelude.so/auth/documentation/step-up-hook.md): API reference for the step-up hook endpoint your backend must implement.
- [Register an Identifier](https://docs.prelude.so/auth/documentation/register-identifier.md): Add a phone number or email address to a logged-in user with an OTP challenge.
- [Passkey (WebAuthn)](https://docs.prelude.so/auth/documentation/passkey.md): Use a WebAuthn credential as a step-up factor, verified by Prelude, no delegation hook involved.
- [Logged-in Change Password](https://docs.prelude.so/auth/documentation/change-password.md): Let authenticated users change their password using direct step-up, without configuring a delegation hook.
- [Server Tokens](https://docs.prelude.so/auth/documentation/server-tokens.md): Authenticate server-to-server requests using OAuth client credentials.
- [Introduction](https://docs.prelude.so/auth/documentation/frontend-sdks/web/introduction.md): Integrate the Prelude Auth SDK into your web application.
- [Password](https://docs.prelude.so/auth/documentation/frontend-sdks/web/password.md): Implement password-based authentication with the Prelude JavaScript SDK.
- [OTP Login](https://docs.prelude.so/auth/documentation/frontend-sdks/web/otp.md): Implement OTP-based authentication with the Prelude JavaScript SDK.
- [Social Login](https://docs.prelude.so/auth/documentation/frontend-sdks/web/social-login.md): Implement social login with the Prelude JavaScript SDK.
- [SAML Login](https://docs.prelude.so/auth/documentation/frontend-sdks/web/saml.md): Implement SAML SSO login with the Prelude JavaScript SDK.
- [Enforce SSO Login](https://docs.prelude.so/auth/documentation/frontend-sdks/web/saml-enforce.md): Transparently fall back to SAML when a domain enforces SSO, with the Prelude JavaScript SDK.
- [Enterprise SSO](https://docs.prelude.so/auth/documentation/frontend-sdks/web/enterprise-oidc.md): Implement enterprise SSO (OIDC) login with the Prelude JavaScript SDK.
- [Session Management](https://docs.prelude.so/auth/documentation/frontend-sdks/web/session-management.md): Manage access tokens, refresh sessions, and handle logout with the Prelude JavaScript SDK.
- [Step-Up Authentication](https://docs.prelude.so/auth/documentation/frontend-sdks/web/step-up.md): Implement step-up authentication with the Prelude JavaScript SDK.
- [Passkey](https://docs.prelude.so/auth/documentation/frontend-sdks/web/passkey.md): Implement passkey (WebAuthn) authentication with the Prelude JavaScript SDK.
- [Change Password](https://docs.prelude.so/auth/documentation/frontend-sdks/web/change-password.md): Implement logged-in change password with the Prelude JavaScript SDK.
- [Introduction](https://docs.prelude.so/auth/documentation/frontend-sdks/mobile/introduction.md): Integrate the Prelude Auth SDK into your mobile application.
- [Password](https://docs.prelude.so/auth/documentation/frontend-sdks/mobile/password.md): Implement password-based authentication with the Prelude mobile SDKs.
- [OTP Login](https://docs.prelude.so/auth/documentation/frontend-sdks/mobile/otp.md): Implement OTP-based authentication with the Prelude mobile SDKs.
- [Social Login](https://docs.prelude.so/auth/documentation/frontend-sdks/mobile/social-login.md): Implement social login with the Prelude mobile SDKs.
- [Session Management](https://docs.prelude.so/auth/documentation/frontend-sdks/mobile/session-management.md): Manage access tokens, refresh sessions, and handle logout with the Prelude mobile SDKs.
- [Step-Up Authentication](https://docs.prelude.so/auth/documentation/frontend-sdks/mobile/step-up.md): Implement step-up authentication with the Prelude mobile SDKs.
- [Change Password](https://docs.prelude.so/auth/documentation/frontend-sdks/mobile/change-password.md): Implement logged-in change password with the Prelude mobile SDKs.
- [Auth Applications](https://docs.prelude.so/auth/documentation/applications.md): Learn how Prelude Auth applications work.
- [Domain Names](https://docs.prelude.so/auth/documentation/domain-names.md): Learn about how to manage domain names for your application.
- [Groups](https://docs.prelude.so/auth/documentation/groups.md): Grant scopes to users in bulk by organizing them into groups.
- [Webhooks](https://docs.prelude.so/auth/documentation/webhooks/introduction.md): Learn about the webhooks used by Prelude Auth.
- [Activation Challenge Request](https://docs.prelude.so/auth/documentation/webhooks/verification-event.md): Handle the activation challenge GET request.
- [User Created](https://docs.prelude.so/auth/documentation/webhooks/events/user-created.md)
- [User Deleted](https://docs.prelude.so/auth/documentation/webhooks/events/user-deleted.md)
- [User Profile Updated](https://docs.prelude.so/auth/documentation/webhooks/events/user-profile-updated.md)
- [User Identifier Created](https://docs.prelude.so/auth/documentation/webhooks/events/user-identifier-created.md)
- [User Identifier Deleted](https://docs.prelude.so/auth/documentation/webhooks/events/user-identifier-deleted.md)
- [User Session Created](https://docs.prelude.so/auth/documentation/webhooks/events/user-session-created.md)
- [User Session Revoked](https://docs.prelude.so/auth/documentation/webhooks/events/user-session-revoked.md)
- [User Passkey Registered](https://docs.prelude.so/auth/documentation/webhooks/events/user-passkey-registered.md)
- [User Passkey Deleted](https://docs.prelude.so/auth/documentation/webhooks/events/user-passkey-deleted.md)
- [User Passkey Assertion Failed](https://docs.prelude.so/auth/documentation/webhooks/events/user-passkey-assertion-failed.md)
- [Migration Hook Failed](https://docs.prelude.so/auth/documentation/webhooks/events/migration-hook-failed.md)
- [Step-Up Hook Failed](https://docs.prelude.so/auth/documentation/webhooks/events/step-up-hook-failed.md)
- [Cookies](https://docs.prelude.so/auth/documentation/cookies.md): Learn about the cookies used by Prelude Auth.
- [JSON Web Key Set (JWKS)](https://docs.prelude.so/auth/documentation/jwks.md): Learn about the JWKS used by the Prelude Auth.
- [Custom Claims](https://docs.prelude.so/auth/documentation/custom-claims.md): Configure the claims included in the access tokens issued by Prelude Auth.
- [Migration Guide](https://docs.prelude.so/auth/documentation/migration-guide.md): Migrate users from a legacy authentication provider to the Prelude Auth API.
- [Create standalone OTP](https://docs.prelude.so/auth/api-reference/frontend/start-login-otp.md): Send an OTP for step-up authentication or standalone verification. Can be initiated with a challenge token (step-up flow) or an identifier (standalone flow).
- [Retry standalone OTP](https://docs.prelude.so/auth/api-reference/frontend/retry-otp.md): Retry sending the OTP message for standalone/step-up verification.
- [Check standalone OTP](https://docs.prelude.so/auth/api-reference/frontend/complete-login-otp.md): Verify the OTP code for standalone/step-up verification. Returns a challenge token.
- [Login with email and password](https://docs.prelude.so/auth/api-reference/frontend/login-email-password.md): Authenticate a user with their email and password. Returns a challenge token to finalize the login.
- [Get password compliancy rules](https://docs.prelude.so/auth/api-reference/frontend/password-compliancy.md): Retrieve the password compliancy requirements for the application.
- [Initiate OAuth authorization](https://docs.prelude.so/auth/api-reference/frontend/oauth-authorize.md): Start an OAuth authorization flow for the given provider. Returns the authorization URL to redirect the user to.
- [Initiate enterprise OAuth (OIDC SSO) authorization](https://docs.prelude.so/auth/api-reference/frontend/oauth-enterprise-authorize.md): Start an enterprise OIDC SSO flow. The connection is resolved either from the user's `email` domain (which must match exactly one enabled connection's `email_domain_allowlist`) or from an explicit `connection_id`; provide exactly one. The provider is derived from the connection, so no provider path…
- [OAuth callback (GET)](https://docs.prelude.so/auth/api-reference/frontend/oauth-callback-get.md): Handle the OAuth provider callback via GET (query parameters). Redirects to the client application with a challenge token or error.
- [OAuth callback (POST)](https://docs.prelude.so/auth/api-reference/frontend/oauth-callback-post.md): Handle the OAuth provider callback via POST (form data). Used by providers like Apple that use form_post response_mode. Redirects to the client application with a challenge token or error.
- [Initiate SAML login (resolve by email)](https://docs.prelude.so/auth/api-reference/frontend/saml-initiate-by-email.md): Start an SP-initiated SAML SSO flow, resolving the connection from the email's domain. The domain must match exactly one enabled connection's `email_domain_allowlist`. On success, returns the IdP URL the SDK navigates the user to; the IdP eventually posts a `SAMLResponse` back to the connection's [A…
- [Initiate SAML login (explicit connection)](https://docs.prelude.so/auth/api-reference/frontend/saml-initiate.md): Start an SP-initiated SAML SSO flow for an explicit `(provider_id, connection_id)` pair. On success, returns the IdP URL the SDK navigates the user to.
- [SAML Assertion Consumer Service (ACS)](https://docs.prelude.so/auth/api-reference/frontend/saml-acs.md): Endpoint the Identity Provider posts the `SAMLResponse` to (HTTP-POST binding). Both IdP-initiated (no `RelayState`) and SP-initiated (the `RelayState` issued by the [initiate](/session/api-reference/frontend/saml-initiate) endpoints) flows land here. On success, redirects to the connection's redire…
- [Get SP metadata](https://docs.prelude.so/auth/api-reference/frontend/saml-metadata.md): Returns the Service Provider (SP) metadata XML for the connection. Upload this document (or its URL) to the Identity Provider when configuring the SAML application. Public; no authentication required.
- [Finalize login](https://docs.prelude.so/auth/api-reference/frontend/finalize-login.md): Finalize a login flow by exchanging a challenge token for session tokens (access + refresh).
- [Migrate a legacy session](https://docs.prelude.so/auth/api-reference/frontend/session-migration.md): Validate a legacy session token via the customer's configured migration hook, create the user if needed, and return a login challenge token. This endpoint requires a migration configuration to be set up for the application.
- [Refresh session](https://docs.prelude.so/auth/api-reference/frontend/refresh-session.md): Spend a refresh token and generate a new access token.
- [Revoke session](https://docs.prelude.so/auth/api-reference/frontend/revoke-session.md): Revoke a refresh token (logout).
- [List sessions](https://docs.prelude.so/auth/api-reference/frontend/list-sessions.md): List all active sessions for the authenticated user.
- [List identifiers](https://docs.prelude.so/auth/api-reference/frontend/list-identifiers.md): List the identifiers (phone numbers, email addresses) for the authenticated user.
- [Revoke sessions](https://docs.prelude.so/auth/api-reference/frontend/revoke-sessions.md): Revoke sessions for the authenticated user. Use the `target` query parameter to specify which sessions to revoke.
- [Change password](https://docs.prelude.so/auth/api-reference/frontend/reset-password.md): Change the password for the authenticated user. Requires a valid access token with write scope.
- [Request step-up scope](https://docs.prelude.so/auth/api-reference/frontend/stepup-request.md): Initiate a step-up authentication flow for the given scope.
- [Continue step-up challenge](https://docs.prelude.so/auth/api-reference/frontend/stepup-continue.md): Verify the customer's verification token and advance the challenge to the next step. A valid DPoP proof (`DPoP` header, RFC 9449) is required on every call to this endpoint.
- [Get JWKS](https://docs.prelude.so/auth/api-reference/frontend/jwks.md): Retrieve the JSON Web Key Set for verifying access tokens.
- [Get step-up JWKS](https://docs.prelude.so/auth/api-reference/frontend/stepup-jwks.md): Retrieve the JSON Web Key Set for verifying step-up tokens.
- [Get authorization server metadata](https://docs.prelude.so/auth/api-reference/frontend/oauth-server-metadata.md): RFC 8414 authorization-server metadata. Advertises the authorize, token, registration, and JWKS endpoints an OAuth/MCP client needs. `registration_endpoint` is present only when Dynamic Client Registration is enabled, and `client_id_metadata_document_supported` is `true` only when Client ID Metadata…
- [Authorization request](https://docs.prelude.so/auth/api-reference/frontend/oauth-server-authorize.md): Start the authorization-code flow (RFC 6749 §4.1). Validates the request, persists it, and `302`-redirects the browser to your login UI with an `oauth_req` query parameter. PKCE is mandatory (`code_challenge` with `code_challenge_method=S256`).
- [Dynamic client registration](https://docs.prelude.so/auth/api-reference/frontend/oauth-server-register.md): Register a client dynamically (RFC 7591). Available only when Dynamic Client Registration is enabled on the app. Public but rate-limited by IP. Redirect URIs are validated against the app's allowlist.
- [Token request](https://docs.prelude.so/auth/api-reference/frontend/oauth-server-token.md): Exchange an authorization `code` (with its PKCE `code_verifier`) for tokens, or rotate a session with `grant_type=refresh_token` (RFC 6749 §4.1.3 and §6). Public client — no client authentication (`token_endpoint_auth_method` is `none`). The request body is `application/x-www-form-urlencoded`.
- [Continue authorization after login](https://docs.prelude.so/auth/api-reference/frontend/oauth-server-continue.md): Called by your login UI once the user has signed in. Attaches the authenticated user to the authorization request and returns the URL of the consent screen to navigate to next. Bound to the live session with an access token and a DPoP proof — the Web SDK issues this call for you.
- [Get pending consent details](https://docs.prelude.so/auth/api-reference/frontend/oauth-server-pending.md): Return the client name, redirect URI, and requested scopes your consent screen should display for a pending authorization request. Bound to the live session with an access token and a DPoP proof.
- [Submit consent decision](https://docs.prelude.so/auth/api-reference/frontend/oauth-server-decision.md): Submit the user's Approve or Deny decision. Returns the client `redirect_uri` to send the browser to — with a `code` (and `state`) on approval, or `error=access_denied` on denial. Bound to the live session with an access token and a DPoP proof.
- [Get application mode](https://docs.prelude.so/auth/api-reference/management/mode/get-mode.md): Get the current mode (dev or prod) of the application.
- [Update application mode](https://docs.prelude.so/auth/api-reference/management/mode/update-mode.md): Update the mode (dev or prod) of the application.
- [Mint a token](https://docs.prelude.so/auth/api-reference/management/tokens/mint-token.md): Mint a signed JWT from an arbitrary claims payload. The token is signed with the application's access-token signing keys, so it verifies against the application's published JWKS exactly like a real access token.
- [List users](https://docs.prelude.so/auth/api-reference/management/users/list-users.md): List all users in the application.
- [Create user](https://docs.prelude.so/auth/api-reference/management/users/create-user.md): Create a user in the application.
- [Get user](https://docs.prelude.so/auth/api-reference/management/users/get-user.md): Get a user by its unique identifier.
- [Delete user](https://docs.prelude.so/auth/api-reference/management/users/delete-user.md): Delete a user by its unique identifier.
- [Update user status](https://docs.prelude.so/auth/api-reference/management/users/update-status.md): Update the status (active/inactive) of a user.
- [Update user profile](https://docs.prelude.so/auth/api-reference/management/users/update-user-profile.md): Update the profile of a user.
- [Update user external ID](https://docs.prelude.so/auth/api-reference/management/users/update-external-id.md): Update the external ID of a user. The external ID is the ID of the user in your system.
- [Set user password](https://docs.prelude.so/auth/api-reference/management/users/set-user-password.md): Set or update the password of a user.
- [Add scope to user](https://docs.prelude.so/auth/api-reference/management/users/add-user-scope.md): Add a scope to a user.
- [Add user to group](https://docs.prelude.so/auth/api-reference/management/users/add-user-to-group.md): Assign a user to a group. Idempotent — a user already in the group is treated as success.
- [Remove user from group](https://docs.prelude.so/auth/api-reference/management/users/remove-user-from-group.md): Remove a user from a group. Idempotent — a user not in the group is treated as success.
- [Create identifier](https://docs.prelude.so/auth/api-reference/management/users/create-identifier.md): Create an identifier for a user.
- [Delete identifier](https://docs.prelude.so/auth/api-reference/management/users/delete-identifier.md): Delete an identifier for a user.
- [List user sessions](https://docs.prelude.so/auth/api-reference/management/users/list-user-sessions.md): List all sessions of a user.
- [Invalidate user sessions](https://docs.prelude.so/auth/api-reference/management/users/invalidate-user-sessions.md): Invalidate all sessions of a user.
- [Invalidate user session](https://docs.prelude.so/auth/api-reference/management/users/invalidate-user-session.md): Invalidate a session of a user by its SessionID.
- [List webhooks](https://docs.prelude.so/auth/api-reference/management/webhooks/list-webhooks.md): List all webhooks for an app.
- [Create webhook](https://docs.prelude.so/auth/api-reference/management/webhooks/create-webhook.md): Create a webhook for an app.
- [Get webhook](https://docs.prelude.so/auth/api-reference/management/webhooks/get-webhook.md): Get a webhook by its WebhookID.
- [Delete webhook](https://docs.prelude.so/auth/api-reference/management/webhooks/delete-webhook.md): Delete a webhook by its WebhookID.
- [Add webhook event](https://docs.prelude.so/auth/api-reference/management/webhooks/add-webhook-event.md): Add an event to a webhook.
- [Delete webhook event](https://docs.prelude.so/auth/api-reference/management/webhooks/delete-webhook-event.md): Delete an event from a webhook.
- [Activate webhook](https://docs.prelude.so/auth/api-reference/management/webhooks/activate-webhook.md): Activate a webhook by its WebhookID.
- [Deactivate webhook](https://docs.prelude.so/auth/api-reference/management/webhooks/deactivate-webhook.md): Deactivate a webhook by its WebhookID.
- [List domains](https://docs.prelude.so/auth/api-reference/management/domains/list-domains.md): List all domains for an application.
- [Create domain](https://docs.prelude.so/auth/api-reference/management/domains/create-domain.md): Create a domain for an application.
- [Get domain](https://docs.prelude.so/auth/api-reference/management/domains/get-domain.md): Get a domain by its identifier.
- [Delete domain](https://docs.prelude.so/auth/api-reference/management/domains/delete-domain.md): Delete a domain by its identifier.
- [Validate domain](https://docs.prelude.so/auth/api-reference/management/domains/verify-domain.md): Validate a domain by its identifier. This will retry verifying the CNAME record on your domain.
- [List scopes](https://docs.prelude.so/auth/api-reference/management/config/scopes/list-scopes.md): List all configured scopes for the application.
- [Create scope](https://docs.prelude.so/auth/api-reference/management/config/scopes/create-scope.md): Add a new scope to the application configuration.
- [Delete scope](https://docs.prelude.so/auth/api-reference/management/config/scopes/delete-scope.md): Remove a scope from the application configuration.
- [List groups](https://docs.prelude.so/auth/api-reference/management/config/groups/list-groups.md): List all configured groups for the application.
- [Create group](https://docs.prelude.so/auth/api-reference/management/config/groups/create-group.md): Create a new group. Every scope must be one of the application's allowed scopes.
- [Get group](https://docs.prelude.so/auth/api-reference/management/config/groups/get-group.md): Fetch a single group by name.
- [Set group scopes](https://docs.prelude.so/auth/api-reference/management/config/groups/set-group-scopes.md): Replace the group's scopes. Every scope must be one of the application's allowed scopes.
- [Delete group](https://docs.prelude.so/auth/api-reference/management/config/groups/delete-group.md): Delete a group. Removing the group's members from their sessions is handled separately.
- [Get claims mapping config](https://docs.prelude.so/auth/api-reference/management/config/claims/get-claims-mapping.md): Get the claims mapping configuration for the application.
- [Create claims mapping config](https://docs.prelude.so/auth/api-reference/management/config/claims/create-claims-mapping.md): Create a claims mapping configuration for the application.
- [Update claims mapping config](https://docs.prelude.so/auth/api-reference/management/config/claims/update-claims-mapping.md): Update the claims mapping configuration for the application.
- [Delete claims mapping config](https://docs.prelude.so/auth/api-reference/management/config/claims/delete-claims-mapping.md): Delete the claims mapping configuration for the application.
- [Get step-up config](https://docs.prelude.so/auth/api-reference/management/config/stepup/get-stepup-config.md): Get the step-up authentication configuration for the application.
- [Create step-up config](https://docs.prelude.so/auth/api-reference/management/config/stepup/create-stepup-config.md): Create a step-up authentication configuration for the application.
- [Update step-up config](https://docs.prelude.so/auth/api-reference/management/config/stepup/update-stepup-config.md): Update the step-up authentication configuration for the application.
- [Delete step-up config](https://docs.prelude.so/auth/api-reference/management/config/stepup/delete-stepup-config.md): Delete the step-up authentication configuration for the application.
- [Get migration config](https://docs.prelude.so/auth/api-reference/management/config/migration/get-migration-config.md): Get the user migration configuration for the application. The migration configuration lets Prelude Session validate sessions issued by a legacy authentication system while you migrate users over, so end users do not need to sign in again during the cutover.
- [Create migration config](https://docs.prelude.so/auth/api-reference/management/config/migration/create-migration-config.md): Create a user migration configuration for the application. Only one migration configuration can exist per application — use the update endpoint to change the session validation URL afterwards.
- [Update migration config](https://docs.prelude.so/auth/api-reference/management/config/migration/update-migration-config.md): Update the user migration configuration for the application.
- [Delete migration config](https://docs.prelude.so/auth/api-reference/management/config/migration/delete-migration-config.md): Delete the user migration configuration for the application.
- [List OTP login configs](https://docs.prelude.so/auth/api-reference/management/config/login-otp/list-login-otp-configs.md): List all OTP login configurations for the application.
- [Create OTP login config](https://docs.prelude.so/auth/api-reference/management/config/login-otp/create-login-otp-config.md): Create an OTP login configuration for the application.
- [Update OTP login config](https://docs.prelude.so/auth/api-reference/management/config/login-otp/update-login-otp-config.md): Update an OTP login configuration by its identifier.
- [Delete OTP login config](https://docs.prelude.so/auth/api-reference/management/config/login-otp/delete-login-otp-config.md): Delete an OTP login configuration by its identifier.
- [List OAuth login configs](https://docs.prelude.so/auth/api-reference/management/config/login-oauth/list-login-oauth-configs.md): List all OAuth login configurations for the application.
- [Create OAuth login config](https://docs.prelude.so/auth/api-reference/management/config/login-oauth/create-login-oauth-config.md): Create an OAuth login configuration for a specific provider. With `type: personal` (the default) this is the classic social-login config, at most one per provider. With `type: enterprise` it creates a new OIDC SSO connection (returning a generated `connection_id`) and requires the `enterprise` block…
- [Update personal OAuth login config](https://docs.prelude.so/auth/api-reference/management/config/login-oauth/update-login-oauth-config.md): Update the personal (social-login) OAuth configuration for a provider.
- [Delete personal OAuth login config](https://docs.prelude.so/auth/api-reference/management/config/login-oauth/delete-login-oauth-config.md): Delete the personal (social-login) OAuth configuration for a provider.
- [Update enterprise OAuth connection](https://docs.prelude.so/auth/api-reference/management/config/login-oauth/update-enterprise-oauth-connection.md): Update an enterprise OIDC SSO connection. The config type is immutable, and the `enterprise` block's `email_domain_allowlist` must stay non-empty and must not overlap another connection's.
- [Delete enterprise OAuth connection](https://docs.prelude.so/auth/api-reference/management/config/login-oauth/delete-enterprise-oauth-connection.md): Delete an enterprise OIDC SSO connection.
- [List SAML connections](https://docs.prelude.so/auth/api-reference/management/config/login-saml/list-saml-connections.md): List all SAML SSO connections configured for the application.
- [Create SAML connection](https://docs.prelude.so/auth/api-reference/management/config/login-saml/create-saml-connection.md): Create a SAML SSO connection for a provider. Provide exactly one IdP source: `idp_metadata_url`, `idp_metadata_xml`, or an explicit `idp` block. The Service Provider (SP) endpoints in the response are derived from the app domain and the generated connection ID, and are immutable.
- [Get SAML connection](https://docs.prelude.so/auth/api-reference/management/config/login-saml/get-saml-connection.md): Get a single SAML SSO connection.
- [Update SAML connection](https://docs.prelude.so/auth/api-reference/management/config/login-saml/update-saml-connection.md): Apply a partial update to a SAML connection. Omitted fields are left unchanged. The IdP `entity_id` is immutable — delete and recreate the connection to rotate it.
- [Delete SAML connection](https://docs.prelude.so/auth/api-reference/management/config/login-saml/delete-saml-connection.md): Delete a SAML connection. Existing `saml:<connection_id>` user identifiers are retained so historical sessions stay auditable.
- [Get SAML SP metadata](https://docs.prelude.so/auth/api-reference/management/config/login-saml/get-saml-sp-metadata.md): Return the Service Provider (SP) metadata XML for the connection, ready to upload to the Identity Provider.
- [Get password login config](https://docs.prelude.so/auth/api-reference/management/config/login-password/get-login-password-config.md): Get the password login configuration for the application.
- [Create password login config](https://docs.prelude.so/auth/api-reference/management/config/login-password/create-login-password-config.md): Create a password login configuration for the application.
- [Update password login config](https://docs.prelude.so/auth/api-reference/management/config/login-password/update-login-password-config.md): Update the password login configuration for the application.
- [Delete password login config](https://docs.prelude.so/auth/api-reference/management/config/login-password/delete-login-password-config.md): Delete the password login configuration for the application.
- [Get OAuth server config](https://docs.prelude.so/auth/api-reference/management/config/oauth-server/get-oauth-server-config.md): Get the OAuth 2.0 authorization-server configuration for the application.
- [Create or update OAuth server config](https://docs.prelude.so/auth/api-reference/management/config/oauth-server/update-oauth-server-config.md): Enable and configure your application as an OAuth 2.0 authorization server. The presence of the `registration.dcr` and `registration.cimd` objects enables Dynamic Client Registration (RFC 7591) and Client ID Metadata Documents respectively; omit one to leave that mechanism disabled.
- [Delete OAuth server config](https://docs.prelude.so/auth/api-reference/management/config/oauth-server/delete-oauth-server-config.md): Disable the OAuth authorization-server surface for the application.
- [Register OAuth client](https://docs.prelude.so/auth/api-reference/management/config/oauth-server/register-oauth-client.md): Pre-register an OAuth client for a known integration, as an alternative to Dynamic Client Registration or Client ID Metadata Documents. A manually-registered client must carry its own `provider_url` — it does not inherit the app's `default_provider_url`.
- [List OAuth clients](https://docs.prelude.so/auth/api-reference/management/config/oauth-server/list-oauth-clients.md): List the OAuth clients registered for the application.
- [Delete OAuth client](https://docs.prelude.so/auth/api-reference/management/config/oauth-server/delete-oauth-client.md): Remove a registered OAuth client from the application.
- [Introduction to Watch](https://docs.prelude.so/watch/v2/documentation/introduction.md): Protect your business and users from fraud by analyzing in real-time dozens of digital signals to block suspicious users before KYC, keeping your growth secure from the start.
- [Predict the outcome of a verification](https://docs.prelude.so/watch/v2/api-reference/predict-outcome.md): At signup, score the user's phone number or email address (target) as legitimate or suspicious. Scoring-only — does not update counters by itself. When using Feedback, call predict before verification.started on the same target (and correlation_id when used) so feedback can warm Watch auth-start cou…
- [Send feedbacks about verifications](https://docs.prelude.so/watch/v2/api-reference/send-feedbacks.md): Optional. Report verification-funnel steps (verification.started, verification.completed) when you run phone verification outside Prelude Verify. Feeds Watch abuse-rate counters for your own flow. Call Predict on the same target before verification.started and reuse metadata.correlation_id so auth-s…
- [Dispatch real-time events](https://docs.prelude.so/watch/v2/api-reference/dispatch-events.md): Send custom fraud signals from your application (labels and confidence levels). Events capture product-specific risk patterns and are weighted when scoring traffic. Use without Predict or Feedback if you only need to report product-side abuse (for example account.banned). Feedback is a separate, opt…
- [Introduction to Intel](https://docs.prelude.so/intel/v2/documentation/introduction.md): Phone number intelligence API. Retrieve carrier data, line type, portability status, and caller name for any number worldwide.
- [Lookup a phone number](https://docs.prelude.so/intel/v2/api-reference/lookup-a-number.md): Retrieve detailed information about a phone number including carrier data, line type, and portability status.
- [KYC Match](https://docs.prelude.so/intel/v2/api-reference/kyc-match.md): Verify identity attributes (name, address, date of birth, email) against the subscriber record held by the end-user's mobile operator.
- [Look up for phone number](https://docs.prelude.so/intel/v1/api-reference/look-up-for-phone-number.md): Perform a phone number lookup.
- [Introduction to Notify](https://docs.prelude.so/notify/v2/documentation/introduction.md): Create, customize, and send global transactional and marketing messages from a single API.
- [2-Way Messaging with WhatsApp](https://docs.prelude.so/notify/v2/documentation/whatsapp.md): Receive inbound WhatsApp messages from your users and reply within a 24-hour conversation window using native WhatsApp quoted replies.
- [Webhook for the Notify API](https://docs.prelude.so/notify/v2/documentation/webhook.md): Prelude Notify API can notify your application about events using webhooks. Get notified when your messages are delivered, billed, and when users manage their subscription preferences.
- [Marketing Compliance Rules](https://docs.prelude.so/notify/v2/documentation/marketing-compliance.md): Learn about the compliance rules and regulations that apply to marketing messages in different countries.
- [Subscription Management](https://docs.prelude.so/notify/v2/documentation/subscription-management.md): Manage user subscriptions and opt-out preferences for marketing messages with built-in STOP/START/HELP keyword support.
- [Message Scheduling](https://docs.prelude.so/notify/v2/documentation/scheduling.md): Schedule messages for future delivery with automatic compliance enforcement for marketing messages.
- [Supported Locales](https://docs.prelude.so/notify/v2/documentation/supported-locales.md): List of all supported locales for Notify templates.
- [Send a message](https://docs.prelude.so/notify/v2/api-reference/send-a-message.md): Send transactional and marketing messages to your users with one simple endpoint, using Prelude Notify API.
- [Send bulk messages](https://docs.prelude.so/notify/v2/api-reference/send-bulk-messages.md): Send the same message to multiple recipients in a single request using Prelude Notify API.
- [Reply to an inbound message](https://docs.prelude.so/notify/v2/api-reference/send-a-reply.md): Send a free-form text reply to an inbound WhatsApp message within the 24-hour conversation window.
- [List subscription configurations](https://docs.prelude.so/notify/v2/api-reference/management/subscriptions/list-subscription-configs.md): Retrieve a paginated list of subscription management configurations for your account.
- [List subscription phone numbers](https://docs.prelude.so/notify/v2/api-reference/management/subscriptions/list-subscription-phone-numbers.md): Retrieve a paginated list of phone numbers and their subscription statuses for a specific subscription configuration.
- [Get subscription phone number status](https://docs.prelude.so/notify/v2/api-reference/management/subscriptions/get-subscription-phone-number.md): Retrieve the current subscription status for a specific phone number within a subscription configuration.
- [List subscription phone number events](https://docs.prelude.so/notify/v2/api-reference/management/subscriptions/list-subscription-phone-number-events.md): Retrieve a paginated list of subscription events (status changes) for a specific phone number within a subscription configuration.
- [Delete passkey config](https://docs.prelude.so/auth/api-reference/management/config/passkey/delete-passkey-config.md): Delete the WebAuthn Relying Party configuration for the application.
- [Get passkey config](https://docs.prelude.so/auth/api-reference/management/config/passkey/get-passkey-config.md): Get the WebAuthn Relying Party configuration for the application.
- [Create or update passkey config](https://docs.prelude.so/auth/api-reference/management/config/passkey/update-passkey-config.md): Create or update the WebAuthn Relying Party configuration for the application. Changing `rp_id` invalidates existing registered credentials.
- [Batch lookup users](https://docs.prelude.so/auth/api-reference/management/users/batch-lookup.md): Look up multiple users at once by external ID or email address. At least one of `external_ids` or `emails` must be provided. Each list is capped at 100 entries.
- [Anti-Fraud](https://docs.prelude.so/introduction/concepts/anti-fraud.md): Understand how Prelude's fraud prevention algorithm works, the type of fraud it prevents and how to configure it.
- [The Prelude Dashboard](https://docs.prelude.so/introduction/concepts/dashboard.md): Monitor your performance and configure your integration with the Dashboard. To get access to the dashboard, you must first sign up and create an app.
- [Multi-Routing and Multi-Channel delivery](https://docs.prelude.so/introduction/concepts/multi-routing.md): Learn how Prelude partners with multiple providers and channels to guarantee the highest possible delivery rate at the lowest possible cost.
- [Errors](https://docs.prelude.so/introduction/errors.md): The Prelude's V2 API error format and the various error codes returned.

## OpenAPI Specs

- [.spectral](/.spectral.yaml)
- [session-core](/api-reference/session-core.yml)
- [session-management](/api-reference/session-management.yml)
- [v1](/api-reference/v1.yml)
- [v2](/api-reference/v2.yml)
- [gen](/gen.yaml)
- [package-lock](/package-lock.json)
- [package](/package.json)