Start a server-side authentication session and discover which sign-in methods are configured for the organization. This is the first step in the multi-step login flow.

Request body (optional)

• You may omit the body, send an empty JSON object {}, or send { "email": "..." }.
• email in the body is optional and kept for legacy reasons; omitting it does not prevent initialization. The web client typically calls this endpoint without a body and sends email on /authenticate instead.
• When provided, email is stored on the session for correlation with subsequent steps.

Flow:

1. Call this endpoint (optional JSON body as above).
2. Receive a session token in the x-session-token response header.
3. Send that token on subsequent /authenticate requests (x-session-token header).
4. Use allowedMethods and authProviders from the response to render the login UI.

Session token

• Returned as header x-session-token.
• Required for /authenticate (and related steps) until it expires.

Multi-factor authentication

If the organization has MFA, complete multiple authentication steps; each step may return the next step's allowed methods.

{
  "email": "user@example.com"
}

{
  "allowedMethods": [
    "password",
    "google",
    "otp"
  ],
  "message": "Authentication initialized"
}