Sessions
Register and sign in end users, reset passwords, refresh and end sessions, and complete third-party logins.
Register, login, password reset and the login callbacks are designed for the 36Blocks browser widget and mobile SDK. They need an encrypted proxy_state value that only the widget can produce, so call them from your front end rather than from scripts or AI assistants.
After a successful sign-in you get a proxy_auth_token and a refresh_token. Send the token in the proxy_auth_token header on all signed-in calls.
#
Guides
The two ways to represent a session on your backend: token-only or JWT.
Keep a user signed in by exchanging a refresh token for a new session.
What 36Blocks adds to your redirect URL after login, and how to redirect somewhere else.