---
title: "This endpoint is being used by the auth-api when authenticating user credentials just by username, this is only used when trusting the user credentials in auth-api from either Passkeys or Magic link"
method: POST
path: "/v1/account/internal/oauth2/authenticateWithUsername"
tags: ["internal"]
---

# This endpoint is being used by the auth-api when authenticating user credentials just by username, this is only used when trusting the user credentials in auth-api from either Passkeys or Magic link

`POST /v1/account/internal/oauth2/authenticateWithUsername`

## Request

- Base URL: `https://api.thebridge.dev` (the document declares no server; this is the origin it was published from)
- URL: `https://api.thebridge.dev/v1/account/internal/oauth2/authenticateWithUsername`
- Auth: none declared

## Response `200`

- AuthApiAuthenticateResponseDto
  - `appConfig` object, required
  - `userId` string, required: This is user.id not tenantUser.id
  - `tenantUsers` AuthTenantUserResponseDto[], required
    - `id` string, required: Unique ID
    - `role` string, required: Role of the user. Grants a set of privileges. Privileges are configured on the `App` model.
    - `email` string, required: Email address, same as username ATM
    - `username` string, required: Username, same as Email address ATM
    - `firstName` string, required: Users first name
    - `lastName` string, required: Users last name
    - `fullName` string, required: Users full name (first name and last name concatenated)
    - `onboarded` boolean, required: If user is onboarded or not (should be put through app onboarding)
    - `consentsToPrivacyPolicy` boolean, required: If user have left consent to the app privacy policy or not (should be set during app onboarding)
    - `tenant` AuthTenantResponse, required
      - `id` string, required
      - `name` string
      - `plan` string
      - `locale` string, required
      - `logo` string
      - `onboarded` boolean, required
  - `mfaState` 'DISABLED' | 'REQUIRED' | 'SETUP', required
  - `mfaChallengeId` string: TBP-775 — id of the server-side MFA challenge; the code itself never leaves the account service.
  - `devCode` string

---

[API](https://skmtc.dev/thebridge/apis/bridge-api.md) · [All operations](https://skmtc.dev/thebridge/apis/bridge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thebridge/apis/bridge-api/revisions/290fffcb3d80?raw)