The API

The SDKs wrap this API; you can also call it directly. The full reference, with every field: API reference (from openapi-v1.json).

Base address	https://api.glow-kin.com
Authentication	Authorization: Bearer tnk_…, your application’s API key, on every request
Format	JSON in UTF-8. Times are ISO 8601 in UTC; IDs are UUIDs
Errors	RFC 9457 problem details (application/problem+json) with a stable code (Errors)
Limits	Request bodies up to 64 KB. Per user: 5 approval requests or emails in 15 minutes, 5 wrong codes per sign-in, 10 in a row lock the method for 15 minutes
Versions	/v1 changes only by adding: new fields, new calls, new values. Ignore what you don’t know, as the SDKs do

The calls

Call	What
POST /v1/users	Create a user, or get the existing one with this externalId
GET /v1/users?externalId=	Find a user without creating one
GET, PATCH, DELETE /v1/users/{id}	Get, rename, delete
GET /v1/methods	Which methods your organization offers
GET, POST /v1/users/{id}/factors	List methods; start setting one up (TOTP, PUSH, EMAIL)
POST …/factors/{factorId}/activate	Finish setting it up with the first code
DELETE …/factors/{factorId}	Remove it
POST /v1/challenges	Start a sign-in’s second step
GET /v1/challenges/{id}	Its status (poll every 2 s for approval)
POST …/{id}/verify	Check a code
POST …/{id}/recover	Pass it with a recovery code or an access pass
POST, GET /v1/users/{id}/recovery-codes	New recovery codes; how many are left
POST /v1/users/{id}/access-passes	A one-time pass from your helpdesk
POST /v1/users/{id}/trusted-devices, …/check	Remember a browser; check its token

Calling it without an SDK

curl -sS https://api.glow-kin.com/v1/users \
  -H "Authorization: Bearer $TENON_AUTH_API_KEY" -H 'Content-Type: application/json' \
  -d '{"externalId":"account-42","displayName":"Taro Yamada"}'

If you write your own client:

• Don’t follow redirects: they would send the key elsewhere.
• Never send a POST again after a timeout: verify and recover count attempts, and a new challenge ends the previous one.
• Treat answers that aren’t JSON (e.g. a proxy’s HTML page) as unavailability.