Integrate
Account management and imports
Changing passwords, deleting accounts, signing in users you've verified yourself, and moving users in.
Managing a user's account
| Action | Call |
|---|---|
| Change password | POST /v1/oauth/change-password { appId, email, currentPassword, newPassword } → 204. Send currentPassword whenever users change their own password; leaving it out skips the check (an admin reset by your trusted backend). Either way the user is signed out of every session. |
| Delete account | DELETE /v1/oauth/account?appId=…&email=… → 204 |
| Sign in a user your backend has already verified (your own magic link, say) | POST /v1/oauth/sso-exchange { appId, email } → tokens. |
Your API key can sign in any of your users through
sso-exchange. Protect it accordingly.Importing existing users
To move users from another system without resetting their passwords, call POST /v1/oauth/users/import { appId, email, legacyPasswordHash, emailVerified, createdAt } → { userId, created }, once per user.
legacyPasswordHash may be a Django pbkdf2_sha256$<iterations>$<salt>$<hash> value; other formats import without a password, and those users reset it. On the first successful sign-in Identise checks the legacy hash and replaces it with its own.
Importing an email that already exists returns it unchanged with created: false, so you can run the import again safely.