Central login: verify the 2nd-factor assertion → SSO session (aal=2) + brand redirect URL

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.

Download OpenAPI JSON
POST /oauth/signin/login/mfa/webauthn