---
title: "Auth Config Bootstrap"
method: GET
path: "/auth/config"
tags: ["auth"]
---

# Auth Config Bootstrap

`GET /auth/config`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/auth/config`
- Auth: none declared

Public: given an optional `tenant_code`, reports how that tenant's login UI should authenticate (native OTP/passkey/SIWE vs. Privy custom auth), plus the tenant's public `privy_app_id` (never a secret) so the client can initialize the right SDK before the user picks a method. Also publishes what a drop-in login widget needs pre-auth: the OTP `methods` the tenant can use now (`phone` only with a usable Twilio Verify connection), `otp_length`, the tenant's `name`/`logo_url`, and `self_join_policy`. The join code is never echoed back. An expired workspace code gets 404 `tenant_code_expired`.

## Query parameters

- `tenant_code` string

## Response `200`

OK

- InternalDeliveryHttpHandlerAuthConfigResponse
  - `data` EnforcerV3InternalUsecaseAuthAuthConfigResult
    - `auth_provider` string
    - `methods` string[]: Methods are the sign-in methods this tenant can use right now: "email" always (native), "phone" only with a usable Twilio Verify connection — the same check RequestSMS makes, so a client never offers a phone tab that would answer "not configured" — and "passkey" only when a passkey relying party serves this tenant on the host asked (the same lookup the passkey ceremonies make).
    - `otp_length` integer: OTPLength is the digits in an emailed code.
    - `passkey_signup` boolean: PasskeySignup: a new person may sign up here with only a passkey (POST /auth/passkey/signup/begin). True only for an open, native workspace that allows passkeys, with a relying party on this host and Turnstile configured; the daily cap is not reflected here.
    - `privy_app_id` string
    - `self_join_policy` 'open' | 'invite_only': SelfJoinPolicy: "invite_only" tenants refuse an address with no account and no pending invite (RequestOTP mails it a no-access notice instead).
    - `tenant` EnforcerV3InternalUsecaseAuthAuthConfigTenant
      - `logo_url` string
      - `name` string
  - `success` boolean

## Other responses

- `400`: Bad Request
- `404`: Not Found

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)