Authentication Management
auth_manageFastio sign-in and credentials (write): PKCE browser sign-in, signup, signout, set an API key, email verification, password reset, 2FA enrolment, API key create/update/delete, OAuth session update/revoke. Password signin and 2fa-verify are refused. Destructive: api-key-delete, oauth-revoke, oauth-revoke-all. Reads are on auth.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| code | No | Verification or authorization code. Meaning is action-specific — see action='describe' for the per-action reference (e.g. reset code for password-reset). pkce-complete ignores it. | |
| name | No | API key label. | |
| admin | No | pkce-login only. Request the admin access mode (`rwa`) as a CEILING on the consent screen. Default false. A ceiling is not a grant: the human must still tick the toggle, and the granted set is whatever `auth action=scopes` reports afterwards. | |
| No | Email address. | ||
| token | No | 2FA / verification token. Meaning is action-specific — see action='describe' for the per-action reference (e.g. 2FA-disable token, 2fa-verify-setup token, 2FA token for api-key-create/api-key-delete). | |
| action | Yes | Operation. Use 'describe' for full action reference. | |
| key_id | No | API key identifier. | |
| scopes | No | Scope strings "entity:id:mode" with mode r | rw | rwa (rwa = read-write + admin access mode; a implies rw), e.g. ["org:123:rwa", "userdetails:*:rw", "user:*:r"]. api-key-create/update: omit for full access. oauth-update: REQUIRED and must be narrower-or-equal; an empty list is refused — use oauth-revoke instead. | |
| api_key | No | Fastio API key. | |
| channel | No | 2FA channel. | |
| expires | No | Token lifetime in seconds. | |
| password | No | Account password. | |
| last_name | No | Family name. | |
| password1 | No | New password. | |
| password2 | No | New password confirmation. | |
| agent_name | No | Agent name for the approval screen and audit logs. If omitted on pkce-login this DEFAULTS to the MCP client's self-reported name (clientInfo.name from initialize), which is caller-supplied and NOT platform-verified — a human approves it on the consent screen, but it is not a vouched vendor. Pass it explicitly to control what is recorded. | |
| first_name | No | Given name. | |
| scope_type | No | PKCE scope type. Default 'user' (full access). | |
| session_id | No | OAuth session identifier. | |
| email_token | No | Email verification code. | |
| key_expires | No | ISO 8601 expiration datetime. | |
| describe_action | No | With action='describe': return one action's params and notes instead of the action index. | |
| exclude_current | No | Skip current session in revoke-all. | |
| account_settings | No | pkce-login only. Request the account-settings scope (`userdetails:*:rw`, gating password/email changes, 2FA enrolment and sign-out-all) as a CEILING on the consent screen. Default false. A ceiling is not a grant: the human must still tick the toggle, and the granted set is whatever `auth action=scopes` reports afterwards. | |
| current_session_id | No | Current session ID for exclusion. |