> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Start provider sign-in > Starts the provider's sign-in flow. For browser-based providers the response carries a URL for the client to open; completion is reported on the returned auth session status and reflected in the provider's authState. Credentials are stored so another user on the machine cannot read them. Expired credentials prompt re-authorisation via this same operation — they never silently fail. The body chooses between the two methods. `key` carries a key the person typed and answers once the host has probed it against the provider's own API — so this call is as slow as that probe, and a rejected key is never stored. `subscription` runs the provider's OAuth flow inside the host and answers as soon as there is a URL to open, leaving the flow running; the client polls getProviderAuth for its outcome. A sign-in already in flight for this provider is never started a second time: a `subscription` request is answered with the attempt as it stands, and a `key` request is refused with 409 — its outcome would otherwise overwrite the running flow's record. A hosted home refuses `subscription` with 422: its flow opens a browser on the home's own machine, so a hosted home signs a provider in with `key`. A sign-in that FAILED is a 202 whose status is `failed`, not an error response: the request was served, the sign-in was not. ## OpenAPI ````yaml /pt/openapi/v3-current/narya.yaml post /v1/providers/{name}/auth openapi: 3.1.0 info: title: Narya Host API version: 1.0.0 description: >- The contract between the Narya host and every client. On your own machine, one long-lived host serves this API over a Unix socket in your Narya home. The terminal client and the one-shot command that Lerian ships drive this API, and a client you write drives the same one. Requests authenticate with a bearer token issued by the identity provider the host is configured with. On your own machine, the host also accepts a request with no token from your own operating system user. Once signed-in work has claimed the home for an organization, it does so only while this machine is signed in to that organization. Such a request gets 401 with NRY-0011 on work that reaches your organization beyond the machine. An operation that declares another security scheme also accepts that credential. Any other request without a valid credential gets 401 with NRY-0011. A caller whose role lacks the permission an operation needs gets 403 with NRY-0028. Submitting a message returns 202 with a turn id. Everything the turn produces streams over GET /v1/events as server-sent events with a typed envelope, and a stream resumes from a Last-Event-ID header. One error envelope: code, title and message. Codes are NRY- followed by four digits. Cursors are opaque. servers: [] security: - bearerAuth: [] tags: - name: host description: The host process itself — version, uptime, mode, store. - name: sessions description: Durable conversation containers. Archive, never destroy. - name: messages description: Submitting work into a session and interrupting it. - name: events description: The server-sent event stream every client consumes. - name: lanes description: Parallel tracks inside a session — main, subagent, side. - name: agents description: Named recipes — instructions, tools, model, policy. Read-only in v1. - name: ladder description: >- What a person can type: the skills and command files in force for one repository, and expanding one into text. Five origins merged, nearest winning a name, the repository's own rungs gated on trust. - name: permissions description: Pending permission asks, decisions, and the decision audit. - name: intercom description: Sessions on one machine finding and messaging each other. - name: packages description: The one thing a user installs — resources, Go code, or both. - name: extensions description: >- Host-side extensions and the operations each exposes over the wire. This is the generic lane a host extension uses to serve its own client half (a TUI component, a web panel) or any API-only consumer, without adding routes to this contract. - name: workflows description: Deterministic multi-agent orchestration runs. - name: providers description: Model suppliers, their auth state, and the model catalogue. - name: monitors description: >- Long-running watchers a session keeps beside its conversation — a test runner in watch mode, a build, a log being followed. Started by the model or by the person, always listed, always killable. - name: records description: The queryable local record of everything that happened. - name: environments description: >- Where a session's code lives and its commands run — this machine, or a container narya operates. A session that names none runs here. - name: schedules description: >- Work the host's own clock starts with nobody present — a repository, a prompt, a rule and what one fire may spend. Cancel, never destroy. - name: sharing description: >- Publishing a session from a developer's own home to the organisation's, and what is held back before a byte leaves the machine. - name: refinements description: >- What this owner has taught narya and allowed it to keep — distilled facts, and the skills, agents and commands the model wrote for itself. Propose, read, consent, roll back. Nothing here fires until a person answers. - name: platform description: >- Calls Lerian's control plane made to a home it hosts, as this home recorded them. paths: /v1/providers/{name}/auth: parameters: - $ref: '#/components/parameters/ProviderNameParam' post: tags: - providers summary: Start provider sign-in description: >- Starts the provider's sign-in flow. For browser-based providers the response carries a URL for the client to open; completion is reported on the returned auth session status and reflected in the provider's authState. Credentials are stored so another user on the machine cannot read them. Expired credentials prompt re-authorisation via this same operation — they never silently fail. The body chooses between the two methods. `key` carries a key the person typed and answers once the host has probed it against the provider's own API — so this call is as slow as that probe, and a rejected key is never stored. `subscription` runs the provider's OAuth flow inside the host and answers as soon as there is a URL to open, leaving the flow running; the client polls getProviderAuth for its outcome. A sign-in already in flight for this provider is never started a second time: a `subscription` request is answered with the attempt as it stands, and a `key` request is refused with 409 — its outcome would otherwise overwrite the running flow's record. A hosted home refuses `subscription` with 422: its flow opens a browser on the home's own machine, so a hosted home signs a provider in with `key`. A sign-in that FAILED is a 202 whose status is `failed`, not an error response: the request was served, the sign-in was not. operationId: startProviderAuth requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/ProviderAuthStart' responses: '202': description: >- Sign-in started, finished, or failed. When browserUrl is present, open it to complete the flow. content: application/json: schema: $ref: '#/components/schemas/ProviderAuthSession' '400': $ref: '#/components/responses/BadRequest' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/Conflict' '413': $ref: '#/components/responses/RequestBodyTooLarge' '422': $ref: '#/components/responses/UnprocessableEntity' '500': $ref: '#/components/responses/InternalServerError' components: parameters: ProviderNameParam: name: name in: path required: true description: The provider's name. schema: type: string pattern: ^[a-z0-9][a-z0-9-]*$ maxLength: 128 schemas: ProviderAuthStart: type: object description: >- Which sign-in to start, and the key when the person typed one. An absent body is the same as `{"method": "key"}` with no key, which is refused — a key method needs a key. properties: method: type: string enum: - key - subscription default: key description: >- `key` stores a key the person typed, after probing it. It is the default because a subscription sign-in launches a browser or a device-code poll, and that must never be a surprise. key: type: string maxLength: 4096 description: >- The provider API key, required for method `key` and refused for any other. It is a secret in transit and at rest: the host stores it in the OS keychain, never in its store, its logs, any transcript, or any error message this operation can answer with. examples: - method: key key: sk-example-not-a-real-key - method: subscription ProviderAuthSession: type: object description: >- A sign-in flow, in flight or finished. When browserUrl is present the client opens it; completion is reflected in the provider's authState. required: - status properties: status: type: string enum: - pending - complete - failed description: >- `pending` means the host is still driving the flow — poll getProviderAuth. `complete` means a credential was probed and stored. `failed` means this attempt is over and message says why; nothing was stored. browserUrl: type: string format: uri description: URL the user opens to complete a browser-based flow. message: type: string maxLength: 1024 description: >- Human-readable instruction, for example a device code to enter — and, on a failed status, why the sign-in failed. On a complete status it names the environment variable whose key turns spend instead of the stored one, when such a variable is set. It never carries the key or token itself. expiresAt: type: string format: date-time description: When the pending flow expires. examples: - status: pending browserUrl: https://auth.example-provider.com/device?code=XQRT-PLMN message: Enter code XQRT-PLMN in the opened page. expiresAt: '2026-08-08T12:50:00.000Z' - status: failed message: openai rejected this credential Error: type: object description: >- The single error envelope every operation returns. Codes are NRY- followed by four digits and are catalogued in the top-level x-error-catalog extension. required: - code - title - message properties: code: type: string pattern: ^NRY-[0-9]{4}$ description: Machine-readable error code from the NRY catalogue. title: type: string maxLength: 256 description: Short human-readable summary of the error class. message: type: string maxLength: 4096 description: Specific, actionable description of what went wrong. fields: type: object description: Per-field validation problems. additionalProperties: type: string examples: - code: NRY-0002 title: Session not found message: >- No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host. responses: BadRequest: description: Malformed request — invalid parameter, cursor, or JSON body. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: >- The caller is authenticated and is not allowed this operation (NRY-0028 or NRY-0030). content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: The addressed resource does not exist on this host. content: application/json: schema: $ref: '#/components/schemas/Error' Conflict: description: >- The resource's current state rejects the request — archived session, busy lane, slot conflict, failed build, already-final state. content: application/json: schema: $ref: '#/components/schemas/Error' RequestBodyTooLarge: description: >- The request body weighs more than this operation accepts (NRY-0024). The host holds one ceiling per operation and refuses at the door, in front of every handler: a body whose declared Content-Length is past the ceiling is refused before a byte of it is read, and a body that declares no length is read only as far as the ceiling and refused there. Nothing was read past that point and nothing was written. content: application/json: schema: $ref: '#/components/schemas/Error' UnprocessableEntity: description: The request was well-formed but failed validation. content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: The host failed — including a store that refuses writes (NRY-0012). content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Enforced on every transport, with no exempt operation. A person's request must carry a JWT issued by the configured identity provider, which the host verifies itself against that issuer's key set: signature, issuer, expiry, and the person and organisation it names. Requests without a valid one receive 401 NRY-0011 — except a request with no token on a laptop's socket from the OS user the kernel names as the host's own, which is that machine's user. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.