> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Start provider sign-in > Starts the provider's sign-in flow. For browser-based providers the response carries a URL for the client to open; completion is reported on the returned auth session status and reflected in the provider's authState. Credentials are stored so another user on the machine cannot read them. Expired credentials prompt re-authorisation via this same operation — they never silently fail. The body chooses between the two methods. `key` carries a key the person typed and answers once the host has probed it against the provider's own API — so this call is as slow as that probe, and a rejected key is never stored. `subscription` runs the provider's OAuth flow inside the host and answers as soon as there is a URL to open, leaving the flow running; the client polls getProviderAuth for its outcome. A sign-in already in flight for this provider is never started a second time: a `subscription` request is answered with the attempt as it stands, and a `key` request is refused with 409 — its outcome would otherwise overwrite the running flow's record. A sign-in that FAILED is a 202 whose status is `failed`, not an error response: the request was served, the sign-in was not. ## OpenAPI ````yaml /en/openapi/v3-current/narya.yaml post /v1/providers/{name}/auth openapi: 3.1.0 info: title: Narya Host API version: 1.0.0 description: >- The contract between the Narya host and every client. One long-lived host runs on your machine and serves this API over a Unix socket in your Narya home. Narya creates the socket owner-only, and file permissions are the whole authorization. There is no password, no token and no TLS. The terminal client and the one-shot command that Lerian ships drive this API, and a client you write drives the same one. Results never arrive on the response of the request that caused them. Submitting a message returns 202 with a turn id. Everything the turn produces streams over GET /v1/events as server-sent events with a typed envelope, and a stream resumes from a Last-Event-ID header. One error envelope: code, title, message, and fields on 422. Codes are NRY- followed by four digits. A paged list answers items, limit and a nextCursor when more remains. Cursors are opaque. servers: [] security: [] tags: - name: host description: The host process itself — version, uptime, mode, store. - name: sessions description: Durable conversation containers. Archive, never destroy. - name: messages description: Submitting work into a session and interrupting it. - name: events description: The server-sent event stream every client consumes. - name: lanes description: Parallel tracks inside a session — main, subagent, side. - name: agents description: Named recipes — instructions, tools, model, policy. Read-only in v1. - name: ladder description: >- What a person can type: the skills and command files in force for one repository, and expanding one into text. Five origins merged, nearest winning a name, the repository's own rungs gated on trust. - name: permissions description: Pending permission asks, decisions, and the decision audit. - name: intercom description: Sessions on one machine finding and messaging each other. - name: packages description: The one thing a user installs — resources, Go code, or both. - name: workflows description: Deterministic multi-agent orchestration runs. - name: providers description: Model suppliers, their auth state, and the model catalogue. - name: monitors description: >- Long-running watchers a session keeps beside its conversation — a test runner in watch mode, a build, a log being followed. Started by the model or by the person, always listed, always killable. - name: records description: The queryable local record of everything that happened. - name: schedules description: >- Work the host's own clock starts with nobody present — a repository, a prompt, a rule and what one fire may spend. Cancel, never destroy. paths: /v1/providers/{name}/auth: parameters: - $ref: '#/components/parameters/ProviderNameParam' post: tags: - providers summary: Start provider sign-in description: >- Starts the provider's sign-in flow. For browser-based providers the response carries a URL for the client to open; completion is reported on the returned auth session status and reflected in the provider's authState. Credentials are stored so another user on the machine cannot read them. Expired credentials prompt re-authorisation via this same operation — they never silently fail. The body chooses between the two methods. `key` carries a key the person typed and answers once the host has probed it against the provider's own API — so this call is as slow as that probe, and a rejected key is never stored. `subscription` runs the provider's OAuth flow inside the host and answers as soon as there is a URL to open, leaving the flow running; the client polls getProviderAuth for its outcome. A sign-in already in flight for this provider is never started a second time: a `subscription` request is answered with the attempt as it stands, and a `key` request is refused with 409 — its outcome would otherwise overwrite the running flow's record. A sign-in that FAILED is a 202 whose status is `failed`, not an error response: the request was served, the sign-in was not. operationId: startProviderAuth requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/ProviderAuthStart' responses: '202': description: >- Sign-in started, finished, or failed. When browserUrl is present, open it to complete the flow. content: application/json: schema: $ref: '#/components/schemas/ProviderAuthSession' '400': $ref: '#/components/responses/BadRequest' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/Conflict' '422': $ref: '#/components/responses/UnprocessableEntity' '500': $ref: '#/components/responses/InternalServerError' components: parameters: ProviderNameParam: name: name in: path required: true description: The provider's name. schema: type: string pattern: ^[a-z0-9][a-z0-9-]*$ maxLength: 128 schemas: ProviderAuthStart: type: object description: >- Which sign-in to start, and the key when the person typed one. An absent body is the same as `{"method": "key"}` with no key, which is refused — a key method needs a key. properties: method: type: string enum: - key - subscription default: key description: >- `key` stores a key the person typed, after probing it. It is the default because a subscription sign-in launches a browser or a device-code poll, and that must never be a surprise. key: type: string maxLength: 4096 description: >- The provider API key, required for method `key` and refused for any other. It is a secret in transit and at rest: the host stores it in the OS keychain, never in its store, its logs, any transcript, or any error message this operation can answer with. examples: - method: key key: sk-example-not-a-real-key - method: subscription ProviderAuthSession: type: object description: >- A sign-in flow, in flight or finished. When browserUrl is present the client opens it; completion is reflected in the provider's authState. required: - status properties: status: type: string enum: - pending - complete - failed description: >- `pending` means the host is still driving the flow — poll getProviderAuth. `complete` means a credential was probed and stored. `failed` means this attempt is over and message says why; nothing was stored. browserUrl: type: string format: uri description: URL the user opens to complete a browser-based flow. message: type: string maxLength: 1024 description: >- Human-readable instruction, for example a device code to enter — and, on a failed status, why the sign-in failed. It never carries the key or token itself. expiresAt: type: string format: date-time description: When the pending flow expires. examples: - status: pending browserUrl: https://auth.example-provider.com/device?code=XQRT-PLMN message: Enter code XQRT-PLMN in the opened page. expiresAt: '2026-08-08T12:50:00.000Z' - status: failed message: 'catalog: key rejected for provider "openai"' Error: type: object description: >- The single error envelope every operation returns. Codes are NRY- followed by four digits and are catalogued in the top-level x-error-catalog extension. fields appears only on 422 validation errors, mapping each offending property to its problem. required: - code - title - message properties: code: type: string pattern: ^NRY-[0-9]{4}$ description: Machine-readable error code from the NRY catalogue. title: type: string maxLength: 256 description: Short human-readable summary of the error class. message: type: string maxLength: 4096 description: Specific, actionable description of what went wrong. fields: type: object description: Per-field validation problems. Present on 422 only. additionalProperties: type: string examples: - code: NRY-0002 title: Session not found message: >- No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host. responses: BadRequest: description: Malformed request — invalid parameter, cursor, or JSON body. content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: The addressed resource does not exist on this host. content: application/json: schema: $ref: '#/components/schemas/Error' Conflict: description: >- The resource's current state rejects the request — archived session, busy lane, slot conflict, failed build, already-final state. content: application/json: schema: $ref: '#/components/schemas/Error' UnprocessableEntity: description: >- The request was well-formed but failed validation. The error's fields map names each offending property. content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: The host failed — including a store that refuses writes (NRY-0012). content: application/json: schema: $ref: '#/components/schemas/Error' ````