Login

Authenticates a credential and, on success, issues an enforcer access/refresh token pair (200, handler.AuthResponse). provider in the request selects the scheme and its required fields: email_otp needs email+code, phone_otp needs phone+code, siwe needs message+signature, every other provider needs token (e.g. a Privy access token). 401 on a rejected credential or wrong/expired OTP, 403 account_inactive for a deactivated account or wrong_auth_scheme when the tenant requires a different provider, 404 when no tenant matches the credential, 409 only on a benign concurrent-refresh race elsewhere in the family, 503 when the upstream identity provider (Privy/Google) is unreachable. An expired workspace code gets 404 tenant_code_expired.