Documentation

API reference for Muha Authenticator. Base URL: https://api.muhaauth.cloud/api/v1

All protected endpoints require a Bearer token. Obtain one by logging in via POST /api/v1/auth/login, or use an API key for programmatic access.

API keys are prefixed with muha_live_ or muha_test_ and passed in the Authorization header.

POST /api/v1/auth/signup
Body: { username, email, password, confirmPassword }

POST /api/v1/auth/login
Body: { identifier, password, rememberMe?, deviceName? }

Both endpoints return { user, accessToken, refreshToken, expiresIn }.

POST /api/v1/mfa/enroll
Returns: { secret, otpauthUri, enrollment }

POST /api/v1/mfa/confirm
Body: { code }
Confirms enrollment with a valid TOTP code.

POST /api/v1/mfa/verify
Body: { code }
Verifies a TOTP code against the enrolled secret.

GET /api/v1/vault
Returns the encrypted vault blob or null.

PUT /api/v1/vault
Body: { ciphertext, nonce, salt, version, revisionId, expectedRevisionId? }
Uploads an encrypted vault. Use expectedRevisionId for optimistic concurrency.

All errors follow a consistent format:
{ error: { code, message, details?, requestId? } }

Common codes: VALIDATION_ERROR, UNAUTHORIZED, FORBIDDEN, NOT_FOUND, CONFLICT, RATE_LIMITED

Need help? Visit the Developer Overview or create an account to access the dashboard.