# Get login methods

Retrieves all login methods for a specific application. **Required permissions**: `apps:read`, `*:read`, `config:read`, `authentication-methods:read`, `[appId]:read`.

Endpoint: GET /loginPreferences/{appId}
Security: ClientAccessToken

## Security:

  - `ClientAccessToken` (unknown)
    oauth2

## Path parameters:

  - `appId` (string, required)
    ID of the application whose login methods you want to retrieve

## Response 200 fields (application/json):

  - `result` (object, required)

  - `result.auth_methods` (object, required)
    Login preferences

  - `result.auth_methods.google` (object)
    Google login configuration

  - `result.auth_methods.google.clientId` (string, required)
    Client ID retrieved from the identity provider

  - `result.auth_methods.google.clientSecret` (string)
    Client Secret retrieved from the identity provider

  - `result.auth_methods.google.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.auth_methods.facebook` (object)
    Facebook login configuration

  - `result.auth_methods.facebook.clientId` (string, required)
    Client ID retrieved from the identity provider

  - `result.auth_methods.facebook.clientSecret` (string)
    Client Secret retrieved from the identity provider

  - `result.auth_methods.facebook.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.auth_methods.facebook.blockSignupWithoutEmail` (boolean)
    Blocks creating a new user when Facebook does not return an email address, which happens when the end-user declines to share their email on the consent screen. Existing users are not affected. Applies to OIDC login only; backend authentication is not affected.

  - `result.auth_methods.facebook.rerequestDeclinedScopes` (boolean)
    If a user previously declined to share their email during Facebook login, they will be asked to share it again on every login until they do. Applies to both OIDC login and backend authentication.

  - `result.auth_methods.email` (object)
    Email magic link login configuration

  - `result.auth_methods.email.expiresIn` (number, required)
    Number of minutes until the email link/code expires

  - `result.auth_methods.email.linksPerUser` (number, required)
    Allowed magic links to send a user per minute

  - `result.auth_methods.email.message` (object, required)

  - `result.auth_methods.email.message.primaryColor` (string, required)
    Primary color of the email, specified as a Hex color

  - `result.auth_methods.email.message.from` (string)
    Origin of the email message

  - `result.auth_methods.email.message.subject` (string)
    Subject of the email message

  - `result.auth_methods.email_otp` (object)
    Email one time password login configuration

  - `result.auth_methods.email_otp.expiresIn` (number, required)
    Number of minutes until the OTP expires

  - `result.auth_methods.email_otp.lockoutDuration` (number)
    OTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.auth_methods.email_otp.maxFailures` (number, required)
    Number of wrong OTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.auth_methods.email_otp.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.auth_methods.email_otp.crossClientsAllowed` (boolean)
    Determines if OTP authentication is allowed across different clients within the same application

  - `result.auth_methods.apple` (object)
    Apple login configuration

  - `result.auth_methods.apple.clientId` (string, required)
    Services ID retrieved from Apple

  - `result.auth_methods.apple.clientSecret` (string)
    Client Secret Signing Key retrieved from Apple

  - `result.auth_methods.apple.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.auth_methods.apple.appleTeamId` (string, required)
    Apple Team ID

  - `result.auth_methods.apple.keyId` (string, required)
    Apple Key ID

  - `result.auth_methods.sms` (object)
    SMS one time password login configuration

  - `result.auth_methods.sms.expiresIn` (number, required)
    Number of minutes until the OTP expires

  - `result.auth_methods.sms.lockoutDuration` (number)
    OTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.auth_methods.sms.maxFailures` (number, required)
    Number of wrong OTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.auth_methods.sms.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.auth_methods.sms.crossClientsAllowed` (boolean)
    Determines if OTP authentication is allowed across different clients within the same application

  - `result.auth_methods.webauthn_api` (object)
    WebAuthn API configuration

  - `result.auth_methods.webauthn_api.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.auth_methods.webauthn_api.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.auth_methods.webauthn_api.lockoutTiers.attempts` (number, required)
    Number of failed attempts before this tier is triggered
    Example: 3

  - `result.auth_methods.webauthn_api.lockoutTiers.duration` (number, required)
    Lockout duration in minutes for this tier
    Example: 15

  - `result.auth_methods.webauthn_api.rpId` (string, required)
    Domain to which WebAuthn credentials are registered and used to authenticate (e.g., example.com)

  - `result.auth_methods.webauthn_api.rpWebOrigins` (array)
    A list of Web origins that will be used to request registration and authentication. The origin must match the domain of the RP ID, but may be a subdomain of the RP ID (e.g., https://login.example.com ). The origin must also include the HTTPS scheme and port (if relevant).

  - `result.auth_methods.webauthn_api.rpMobileOrigins` (array)
    A list of mobile origins that will be used to request registration and authentication. The origin must match the domain of the RP ID.

  - `result.auth_methods.webauthn_api.replaceExistingPasskey` (boolean)
    Set to true in order to replace the existing passkey. Default is False.

  - `result.auth_methods.webauthn_api.maxFailures` (number)
    Number of wrong attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.auth_methods.webauthn_api.lockoutDuration` (number)
    Lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.auth_methods.webauthn_api.allowSyncedPasskeys` (boolean)
    Allow synced passkeys

  - `result.auth_methods.webauthn_api.enforceAttestation` (boolean)
    Enforce attestation for device-bound passkeys

  - `result.auth_methods.webauthn_api.attestationType` (string)
    Attestation conveyance preference (none, indirect, or direct)
    Enum: "none", "indirect", "direct"

  - `result.auth_methods.webauthn_api.aaguidAllowList` (array)
    List of allowed AAGUIDs (Authenticator Attestation GUIDs). If specified, only authenticators with these AAGUIDs will be accepted. Mutually exclusive with aaguidBlockList.

  - `result.auth_methods.webauthn_api.aaguidBlockList` (array)
    List of blocked AAGUIDs (Authenticator Attestation GUIDs). Authenticators with these AAGUIDs will be rejected. Mutually exclusive with aaguidAllowList.

  - `result.auth_methods.webauthn_api.rpOrigin` (string)
    Web origin that will be used to request registration and authentication. The origin must match the domain of the RP ID, but may be a subdomain of the RP ID (e.g., https://login.example.com ). The origin must also include the HTTPS scheme and port (if relevant).

  - `result.auth_methods.webauthn_api.rpOrigins` (array)
    Use rpWebOrigins or rpMobileOrigins instead

  - `result.auth_methods.line` (object)
    Line login configuration

  - `result.auth_methods.password` (object)
    Password login configuration

  - `result.auth_methods.password.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.auth_methods.password.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.auth_methods.password.resetValidityMinutes` (number, required)
    Number of minutes until reset password token/OTP expires.
    Example: 5

  - `result.auth_methods.password.passwordComplexity` (number, required)
    Password complexity. Must be between 1 and 5.
    Example: 5

  - `result.auth_methods.password.passwordMinLength` (number, required)
    Minimum required length of the password.
    Example: 14

  - `result.auth_methods.password.blockPreviousPasswords` (number, required)
    Number of most recent passwords to block the user from setting as their new password.
    Example: 0

  - `result.auth_methods.password.checkHibp` (boolean)
    Check password updates against HIBP.

  - `result.auth_methods.password.checkDictionary` (boolean)
    Check password updates against a predefined dictionary.

  - `result.auth_methods.password.passwordExpiresIn` (number, required)
    Number of days until the password expires. Must be between 1 and 1096 days (3 years).
    Example: 90

  - `result.auth_methods.password.ignoreExpiration` (boolean)
    Ignore password expiration. If true, the password will never expire.

  - `result.auth_methods.password.maxPasswordFailures` (number)
    Number of wrong password attempts allowed before the user is suspended. Must be between 1 and 20.
    Example: 5

  - `result.auth_methods.password.passwordSuspensionDuration` (number)
    Number of minutes to suspend the user from authenticating using password after the maximum number of allowed failed attempts is exceeded. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.auth_methods.password.tempPasswordValidityHours` (number)
    Number of hours until temporary passwords are considered expired. Must be between 1 and 8760 hours (1 year).
    Example: 24

  - `result.auth_methods.password.requireMFA` (boolean)
    Require multi-factor authentication for password reset flows.

  - `result.auth_methods.password.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.auth_methods.password.notifyOnPasswordUpdate` (boolean)
    Send email to end-user upon password update

  - `result.auth_methods.totp` (object)
    TOTP login configuration

  - `result.auth_methods.totp.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.auth_methods.totp.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.auth_methods.totp.algorithm` (string)
    The algorithm used to generate the TOTP code
    Enum: "sha1", "sha256", "sha512"

  - `result.auth_methods.totp.digits` (number)
    Number of digits in the generated TOTP code, must be 6 or 8
    Example: 6

  - `result.auth_methods.totp.period` (number)
    Number of seconds in which the TOTP code is valid
    Example: 30

  - `result.auth_methods.totp.window` (number)
    Number of windows to check for valid TOTP codes
    Example: 2

  - `result.auth_methods.totp.issuer` (string)
    TOTP issuer
    Example: My Company

  - `result.auth_methods.totp.maxFailures` (number)
    Number of wrong TOTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.auth_methods.totp.lockoutDuration` (number)
    TOTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.auth_methods.totp.maxTotpPerUser` (number)
    Maximum number of TOTP authenticators allowed per user. Must be between 1 and 50.
    Example: 1

  - `result.auth_methods.push` (object)
    Push configuration

  - `result.auth_methods.push.apn` (any)
    APN configuration. Can be a single object or an array of objects.

  - `result.auth_methods.push.apn.key` (string, required)
    APN key

  - `result.auth_methods.push.apn.keyId` (string, required)
    APN key id

  - `result.auth_methods.push.apn.teamId` (string, required)
    APN team id

  - `result.auth_methods.push.apn.bundle` (string, required)
    APN bundle

  - `result.auth_methods.push.apn.isProduction` (boolean)
    Is Production APN Environment

  - `result.auth_methods.push.fcm` (object)
    FCM configuration

  - `result.auth_methods.push.fcm.key` (object, required)
    FCM key

  - `result.auth_methods.tiktok` (object)
    TikTok login configuration

  - `result.auth_methods.pin_authenticator` (object)
    PIN authenticator configuration

  - `result.auth_methods.pin_authenticator.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.auth_methods.pin_authenticator.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.auth_methods.pin_authenticator.maxFailures` (number)
    Number of wrong PIN Authenticator attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.auth_methods.pin_authenticator.lockoutDuration` (number)
    PIN Authenticator lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.auth_methods.face` (object)
    Face authenticator configuration

  - `result.auth_methods.face.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.auth_methods.face.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.auth_methods.face.maxFailures` (number)
    Number of wrong Face Authenticator attempts allowed. Must be between 1 and 20.
    Example: 3

  - `result.auth_methods.face.lockoutDuration` (number)
    Face Authenticator lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.auth_methods.face.saveImageEmbedding` (boolean)
    Enables saving the image embedding

## Response 400 fields (application/json):

  - `message` (array, required)
    Example: Bad request

  - `error_code` (number, required)
    Example: 400

## Response 404:

  - `404` (unknown)
    Application Not Found

## Response 404 fields (application/json):

  - `message` (string, required)

  - `error_code` (number, required)
    Example: 404