Docs/Account/Quickstart

Quickstart Guide

Get from zero to authenticated users in under 5 minutes. This guide introduces what Vyntech Account is, why it exists, and walks you through your first integration.

What is Vyntech Account?

Vyntech Account is a fully managed identity and access management platform. Instead of building auth from scratch — password hashing, token signing, session management, MFA, role-based access — you get all of it through a single API. It's designed for SaaS companies, multi-tenant platforms, and any application that needs secure user management.

Think of it as Auth0 or Firebase Auth, but with a built-in behavioral risk engine, per-tenant configuration, and no vendor lock-in.

Why Choose Vyntech Account?

Behavioral Risk Engine

Every login is scored in real time. New device? New country? Impossible travel? The system detects threats before they become breaches.

Per-Tenant Security Policies

Each organization configures their own password rules, MFA requirements, IP allowlists, session limits, and rate limits — no code changes needed.

Multi-Tenant by Default

Users, roles, sessions, and policies are fully isolated per tenant. Give every customer their own identity space without separate infrastructure.

Complete Auth Flows

Login, register, password reset, email verification, MFA setup, token refresh — all handled with proper security practices built in.

Webhook & Email Notifications

Get notified when users log in, passwords change, sessions are revoked, or risk events are detected. HMAC-signed webhooks with 3x retry.

Developer-First APIs

REST, GraphQL, and gRPC. EdDSA-signed JWTs. OIDC discovery. Public endpoints for branding and password policy. Integrate in minutes.

How It Works

The core flow is simple:

1Create a tenant — represents an organization (your customer, or your own company).
2Users register — within a tenant, with email verification and password policy enforcement.
3Users log in — credentials are verified, risk is assessed, MFA is enforced if configured, and tokens are issued.
4Your app verifies tokens — validate the EdDSA-signed JWT in your backend. Claims include user ID, tenant ID, roles, and permissions.
5Everything is configurable — adjust security settings, enable webhooks, customize branding — all via API or admin panel.

Let's Build

Follow the steps below to have your first authenticated user in under 5 minutes.

Prerequisites

•A Vyntech Account instance (cloud or self-hosted) — base URL: https://id.vyntech.com.au
•curl or any HTTP client (Postman, HTTPie, fetch)
•A platform admin account (created during initial setup)

Create a Tenant

A tenant represents an organization in your system. Every user, role, and session is scoped to a tenant. Create one via the admin panel or API:

POST/api/v1/tenants/register🔒 Auth

Creates a new tenant and its first owner user atomically. Returns tokens for immediate use.

curl -X POST https://id.vyntech.com.au/api/v1/tenants/register \ -H "Authorization: Bearer <admin_token>" \ -H "Content-Type: application/json" \ -d '{ "tenant_name": "Acme Corp", "tenant_slug": "acme-corp", "plan": "pro", "email": "admin@acme.com", "password": "SecureP@ss123!", "display_name": "Admin User" }'

Register a User

Register a user within your tenant. The password is validated against the tenant's configured policy (default: 8+ chars, uppercase, number).

POST/api/v1/auth/registerPublic

Creates a new user within a tenant. Sends a verification email if configured.

curl -X POST https://id.vyntech.com.au/api/v1/auth/register \ -H "Content-Type: application/json" \ -d '{ "tenant_id": "d077cade-afdd-46b2-acc3-9427e46b2ced", "email": "jane@acme.com", "password": "MyStr0ng!Pass", "display_name": "Jane Smith" }'

Authenticate (Login)

Authenticate with email and password. The response includes a short-lived access token (15min) and a long-lived refresh token (7 days). Every login is evaluated by the risk engine.

POST/api/v1/auth/loginPublic

Authenticates a user. Risk engine evaluates every attempt. Returns tokens or MFA challenge.

curl -X POST https://id.vyntech.com.au/api/v1/auth/login \ -H "Content-Type: application/json" \ -d '{ "tenant_id": "d077cade-afdd-46b2-acc3-9427e46b2ced", "email": "jane@acme.com", "password": "MyStr0ng!Pass" }'

Risk Engine Active

Every login is scored by the behavioral risk engine. If the score exceeds your tenant's threshold, the user will be challenged (step-up MFA) or blocked. You can configure thresholds in Settings → Behavior.

Use the Access Token

Include the access token in the Authorization header for all authenticated API requests:

GET/api/v1/me🔒 Auth

Returns the authenticated user's profile, tenant info, roles, and permissions.

curl https://id.vyntech.com.au/api/v1/me \ -H "Authorization: Bearer eyJhbGciOiJFZERTQSIs..."

Refresh Tokens

When the access token expires (15min default), use the refresh token to get a new pair. The old refresh token is invalidated (rotation).

POST/api/v1/auth/refreshPublic

Exchange a valid refresh token for a new access + refresh token pair.

curl -X POST https://id.vyntech.com.au/api/v1/auth/refresh \ -H "Content-Type: application/json" \ -d '{"refresh_token": "eyJhbGciOiJFZERTQSIs..."}'

What's Next

Enable MFA →

Add TOTP-based two-factor authentication

Configure Settings →

Customize password policy, session limits, and more

Set Up Webhooks →

Receive real-time event notifications

Risk Engine →

Understand behavioral risk scoring