# Account & Authentication — REST API Reference

- [Authentication](authentication.md) — Login, token refresh, password reset
- [Passkeys](passkeys.md) — Passwordless login with WebAuthn/FIDO2
- [TOTP / Authenticator App](mfa_totp.md) — 2FA and standalone login with Google Authenticator etc.
- [SMS OTP](mfa_sms.md) — 2FA and standalone login via SMS code
- [Magic Login Links](magic_login.md) — Passwordless login via emailed link
- [OAuth / Social Login](oauth.md) — Login with Google (and more)
- [Email & Phone Verification](email_verification.md) — Verification gates, send/verify flow, invite links
- [Email Change](email_change.md) — Self-service email address change with password confirmation
- [Phone Number Change](phone_change.md) — Self-service phone number change with OTP verification
- [User Self-Management](user_self_management.md) — Everything a logged-in user can do for their own account (profile, avatar, password, email, phone, passkeys, TOTP, files, notifications, activity log)
- [User API](user.md) — User profile, registration, password reset
- [Group API](group.md) — Groups, membership, permissions
- [Admin Portal API Guide](admin_portal.md) — Building admin consoles (users, groups, secure settings)
- [API Keys](api_keys.md) — Long-lived tokens for programmatic access
- [Custom Auth Models](custom_auth_models.md) — JWT, OAuth, and passkeys for non-User models (e.g. game.Player)
- [Notifications](notifications.md) — Inbox, mark read, WebSocket delivery
