Authentication

User authentication uses an OIDC session backed by secure HTTP-only cookies. Browser requests must include credentials: include, and all authentication requests require the x-blocks-key header.

Initiate login

GET /iam/v4/idp/initiate

Query parameter	Required	Description
x-blocks-key	Yes	Tenant/project key
clientId	Yes	Registered OIDC client ID
redirectUri	Yes	Exact registered callback URI

curl --get 'https://api.seliseblocks.com/iam/v4/idp/initiate' \
  -H 'Accept: application/json' \
  -H 'x-blocks-key: YOUR_PROJECT_KEY' \
  --data-urlencode 'x-blocks-key=YOUR_PROJECT_KEY' \
  --data-urlencode 'clientId=YOUR_CLIENT_ID' \
  --data-urlencode 'redirectUri=https://app.example.com/callback'

The JSON response contains a redirect URL under a field such as redirect_uri, authorizationUrl, or url. Navigate the browser to that URL.

Complete the callback

GET /iam/v4/idp/callback?code=...&state=...

Pass the code and state returned to the registered redirect URI.

curl --get 'https://api.seliseblocks.com/iam/v4/idp/callback' \
  -H 'x-blocks-key: YOUR_PROJECT_KEY' \
  --data-urlencode 'code=AUTHORIZATION_CODE' \
  --data-urlencode 'state=STATE'

The response establishes the authenticated session.

Check the session

GET /iam/v4/oidc/session

Returns a successful status while the cookie-backed session is valid.

Obtain a machine access token

Use the client credentials grant for server-to-server authentication when no user is present.

POST /iam/v4/oidc/token

Form parameter	Required	Description
grant_type	Yes	Must be client_credentials
client_id	Yes	Client ID issued for the OIDC client
client_secret	Yes	Client secret issued for the OIDC client
org_id	Yes	Organization the client accesses; use default for the default organization

curl --location 'https://api.seliseblocks.com/iam/v4/oidc/token' \
  --header 'x-blocks-key: YOUR_PROJECT_KEY' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id=YOUR_CLIENT_ID' \
  --data-urlencode 'client_secret=YOUR_CLIENT_SECRET' \
  --data-urlencode 'org_id=default'

Keep the client secret on the server. Do not expose it in browser code, mobile apps, source control, or logs.

Refresh the session

POST /iam/v4/oidc/token

curl -X POST 'https://api.seliseblocks.com/iam/v4/oidc/token' \
  -H 'x-blocks-key: YOUR_PROJECT_KEY' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=refresh_token' \
  --data-urlencode 'client_id=YOUR_CLIENT_ID'

The example retries an IAM request once after a 401 when refresh succeeds.

Activate an invited account

POST /iam/v4/auth/activate

{
  "code": "CODE_FROM_INVITATION",
  "password": "NEW_PASSWORD",
  "firstName": "Ada",
  "lastName": "Lovelace"
}

The one-time code comes from the invitation link. Activation sets the password and enables the account.

Logout

POST /iam/v4/auth/Logout

curl -X POST 'https://api.seliseblocks.com/iam/v4/auth/Logout' \
  -H 'x-blocks-key: YOUR_PROJECT_KEY' \
  -H 'Content-Type: application/json' \
  --data '{}'

Logout revokes the server-side session.