Quickstart Guide
Get from zero to authenticated users in under 5 minutes. This guide introduces what Vyntech Account is, why it exists, and walks you through your first integration.
What is Vyntech Account?
Vyntech Account is a fully managed identity and access management platform. Instead of building auth from scratch — password hashing, token signing, session management, MFA, role-based access — you get all of it through a single API. It's designed for SaaS companies, multi-tenant platforms, and any application that needs secure user management.
Think of it as Auth0 or Firebase Auth, but with a built-in behavioral risk engine, per-tenant configuration, and no vendor lock-in.
Why Choose Vyntech Account?
Behavioral Risk Engine
Every login is scored in real time. New device? New country? Impossible travel? The system detects threats before they become breaches.
Per-Tenant Security Policies
Each organization configures their own password rules, MFA requirements, IP allowlists, session limits, and rate limits — no code changes needed.
Multi-Tenant by Default
Users, roles, sessions, and policies are fully isolated per tenant. Give every customer their own identity space without separate infrastructure.
Complete Auth Flows
Login, register, password reset, email verification, MFA setup, token refresh — all handled with proper security practices built in.
Webhook & Email Notifications
Get notified when users log in, passwords change, sessions are revoked, or risk events are detected. HMAC-signed webhooks with 3x retry.
Developer-First APIs
REST, GraphQL, and gRPC. EdDSA-signed JWTs. OIDC discovery. Public endpoints for branding and password policy. Integrate in minutes.
How It Works
The core flow is simple:
- 1Create a tenant — represents an organization (your customer, or your own company).
- 2Users register — within a tenant, with email verification and password policy enforcement.
- 3Users log in — credentials are verified, risk is assessed, MFA is enforced if configured, and tokens are issued.
- 4Your app verifies tokens — validate the EdDSA-signed JWT in your backend. Claims include user ID, tenant ID, roles, and permissions.
- 5Everything is configurable — adjust security settings, enable webhooks, customize branding — all via API or admin panel.
Let's Build
Follow the steps below to have your first authenticated user in under 5 minutes.
Prerequisites
- •A Vyntech Account instance (cloud or self-hosted) — base URL:
https://id.vyntech.com.au - •
curlor any HTTP client (Postman, HTTPie, fetch) - •A platform admin account (created during initial setup)
Create a Tenant
A tenant represents an organization in your system. Every user, role, and session is scoped to a tenant. Create one via the admin panel or API:
registerAuth
Creates a new tenant and its first owner user atomically. Returns tokens for immediate use.
Status Codes
- Name
201- Type
- HTTP
- Description
- Tenant and owner user created successfully
- Name
400- Type
- HTTP
- Description
- Validation failed (missing fields, invalid email, weak password)
- Name
409- Type
- HTTP
- Description
- Tenant slug already taken
- Name
403- Type
- HTTP
- Description
- Insufficient permissions
Register a User
Register a user within your tenant. The password is validated against the tenant's configured policy (default: 8+ chars, uppercase, number).
register
Creates a new user within a tenant. Sends a verification email if configured.
Status Codes
- Name
201- Type
- HTTP
- Description
- User created, tokens returned
- Name
400- Type
- HTTP
- Description
- Validation failed (password policy, invalid email)
- Name
402- Type
- HTTP
- Description
- User limit reached (quota exceeded)
- Name
403- Type
- HTTP
- Description
- Self-registration disabled or email domain not allowed
- Name
409- Type
- HTTP
- Description
- Email already registered in this tenant
Authenticate (Login)
Authenticate with email and password. The response includes a short-lived access token (15min) and a long-lived refresh token (7 days). Every login is evaluated by the risk engine.
login
Authenticates a user. Risk engine evaluates every attempt. Returns tokens or MFA challenge.
Status Codes
- Name
200- Type
- HTTP
- Description
- Login successful — tokens returned (or MFA required)
- Name
401- Type
- HTTP
- Description
- Invalid email or password
- Name
403- Type
- HTTP
- Description
- Account suspended, MFA setup required, email not verified, or risk blocked
- Name
429- Type
- HTTP
- Description
- Too many attempts (account locked)
Risk Engine Active
Every login is scored by the behavioral risk engine. If the score exceeds your tenant's threshold, the user will be challenged (step-up MFA) or blocked. You can configure thresholds in Settings → Behavior.
Use the Access Token
Include the access token in the Authorization header for all authenticated API requests:
meAuth
Returns the authenticated user's profile, tenant info, roles, and permissions.
Status Codes
- Name
200- Type
- HTTP
- Description
- User profile returned
- Name
401- Type
- HTTP
- Description
- Invalid or expired token
Refresh Tokens
When the access token expires (15min default), use the refresh token to get a new pair. The old refresh token is invalidated (rotation).
refresh
Exchange a valid refresh token for a new access + refresh token pair.
Status Codes
- Name
200- Type
- HTTP
- Description
- New token pair issued
- Name
401- Type
- HTTP
- Description
- Invalid or expired refresh token