Skip to content
Tovari Docs

Sign in / sign up with a Google credential

POST
/auth/google
curl --request POST \
  --url https://api.tovarifinancial.com/auth/google \
  --header 'Content-Type: application/json' \
  --data '{ "credential": "example" }'

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
credential
required

Google ID-token credential from GIS

string
Examplegenerated
{
  "credential": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

Existing user authenticated (tokens issued), OR a second factor is required (challenge returned, no tokens)

Media typeapplication/json
object
data
required
One of:

Existing user authenticated — tokens issued.

object
accessToken
required
string
idToken
required
string
refreshToken
required
string
expiresIn
required

Access/ID token lifetime in seconds.

integer
user
required
object
id
required
string format: uuid
email
required
string
name
required
string
nullable
orgId
required
string format: uuid
orgRole
required
string
debugConsoleEnabled
required
boolean
onboardingCompleted
required
boolean
outstandingPolicies
required
Array<object>
object
id
required
string format: uuid
policyType
required
string
version
required
integer
title
required
string
firstAcceptance
required

TRUE when the outstanding policies are a first acceptance rather than an update.

boolean
verification
required
object
status
required

Derived from users.email_verified, the sole source of truth for the gate.

string
Allowed values: verified unverified
codeDeliveryDetails
object
destination
required
string
deliveryMedium
required
string
cooldownSeconds

Seconds the resend button stays disabled after an interactive send.

integer
sendsRemaining
integer
language
required

The session user display-language state (KAN-3773).

object
spanishEnabled
required

The per-environment Spanish rollout flag. False ⇒ effectiveLocale is always ‘en’.

boolean
preference
required

The explicit choice; null = use device language.

string
nullable
Allowed values: en es
detected
required

This request’s X-Client-Locale, else the last-seen device language, else null.

string
nullable
Allowed values: en es
effectiveLocale
required

The language to display: ‘en’ when the flag is off, else preference ?? detected ?? ‘en’.

string
Allowed values: en es
isNewUser
required

Always false on a 200 — a brand-new account answers 201.

boolean
passwordSignInReset
required

TRUE when this request replaced the account password to complete the Google link.

boolean
message
string
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "data": {
    "verification": {
      "status": "verified"
    },
    "language": {
      "preference": "en",
      "detected": "en",
      "effectiveLocale": "en"
    }
  }
}

201

Section titled “201”

New account created from the Google credential; tokens issued

Media typeapplication/json
object
data
required
object
accessToken
required
string
idToken
required
string
refreshToken
required
string
expiresIn
required

Access/ID token lifetime in seconds.

integer
user
required
object
id
required
string format: uuid
email
required
string
name
required
string
nullable
orgId
required
string format: uuid
orgRole
required
string
debugConsoleEnabled
required
boolean
onboardingCompleted
required
boolean
outstandingPolicies
required
Array<object>
object
id
required
string format: uuid
policyType
required
string
version
required
integer
title
required
string
firstAcceptance
required

TRUE when the outstanding policies are a first acceptance rather than an update.

boolean
verification
required
object
status
required

Derived from users.email_verified, the sole source of truth for the gate.

string
Allowed values: verified unverified
codeDeliveryDetails
object
destination
required
string
deliveryMedium
required
string
cooldownSeconds

Seconds the resend button stays disabled after an interactive send.

integer
sendsRemaining
integer
language
required

The session user display-language state (KAN-3773).

object
spanishEnabled
required

The per-environment Spanish rollout flag. False ⇒ effectiveLocale is always ‘en’.

boolean
preference
required

The explicit choice; null = use device language.

string
nullable
Allowed values: en es
detected
required

This request’s X-Client-Locale, else the last-seen device language, else null.

string
nullable
Allowed values: en es
effectiveLocale
required

The language to display: ‘en’ when the flag is off, else preference ?? detected ?? ‘en’.

string
Allowed values: en es
isNewUser
required

Always true on a 201.

boolean
message
string
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "data": {
    "verification": {
      "status": "verified"
    },
    "language": {
      "preference": "en",
      "detected": "en",
      "effectiveLocale": "en"
    }
  }
}

400

Section titled “400”

Validation failed — see errorCode / fieldErrors

Media typeapplication/json
object
errorCode
required

Machine-readable error code (AUTH_ERROR_CODES).

string
Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND
message
required
string
fieldErrors

Optional field-level validation errors, keyed by field name.

object
key
additional properties
Array<string>
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "errorCode": "INVALID_EMAIL_FORMAT"
}

401

Section titled “401”

Missing, invalid, or expired bearer token

Media typeapplication/json
object
errorCode
required

Machine-readable error code (AUTH_ERROR_CODES).

string
Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND
message
required
string
fieldErrors

Optional field-level validation errors, keyed by field name.

object
key
additional properties
Array<string>
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "errorCode": "INVALID_EMAIL_FORMAT"
}

409

Section titled “409”

Conflict — errorCode is one of: IDENTITY_CONFLICT (the verified email belongs to an account already bound to a different Google identity, or the binding was lost to a concurrent request); USER_ALREADY_EXISTS (an account exists for this email that this sign-in cannot link or heal); UNCLAIMED_INVITE_ACCOUNT (the email resolves to an account created by accepting a household invite that has never verified its email — a fixed-message refusal, carrying no details, that writes nothing and tells the user to sign in with the password set when the invitation was accepted and verify their email first).

Media typeapplication/json
object
errorCode
required

Machine-readable error code (AUTH_ERROR_CODES).

string
Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND
message
required
string
fieldErrors

Optional field-level validation errors, keyed by field name.

object
key
additional properties
Array<string>
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "errorCode": "INVALID_EMAIL_FORMAT"
}

500

Section titled “500”

Internal error (no internal detail leaked)

Media typeapplication/json
object
errorCode
required

Machine-readable error code (AUTH_ERROR_CODES).

string
Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND
message
required
string
fieldErrors

Optional field-level validation errors, keyed by field name.

object
key
additional properties
Array<string>
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "errorCode": "INVALID_EMAIL_FORMAT"
}

503

Section titled “503”

Service temporarily unavailable — errorCode is SERVICE_UNAVAILABLE. A TRANSIENT, RETRYABLE condition rather than a defect in the request: a query that exceeded its time budget, a lost or refused database connection, a saturated connection pool, or an outage at an upstream provider the request depends on (the authentication provider, or the bank data provider on a bank-connection operation). The identical request may succeed on retry — back off briefly and, on a write, resend the same X-Idempotency-Key where the operation accepts one.

Media typeapplication/json
object
errorCode
required

Machine-readable error code (AUTH_ERROR_CODES).

string
Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND
message
required
string
fieldErrors

Optional field-level validation errors, keyed by field name.

object
key
additional properties
Array<string>
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "errorCode": "INVALID_EMAIL_FORMAT"
}