DEVELOPER INTEGRATION · VERSION 1.0.0

Registration and recovery

Registration is central. A verified account can enter every connected citizen program; each program creates its local profile on first sign-in.

Use hosted account pages

Create account: https://identity.city.digikraft-technologies.com/register/
Sign in: https://identity.city.digikraft-technologies.com/login/ — start program sign-in through its backend, so state and callbacks are preserved.
Recover password: https://identity.city.digikraft-technologies.com/recover/

A citizen supplies their name, email and optional phone. The emailed verification link verifies the address and lets them set their password. A separate API password field is not accepted. Phone numbers are not verified and are not the current login identifier.

Or use the shared enrollment API

POST https://identity.city.digikraft-technologies.com/api/v1/accounts/register/
Content-Type: application/json

{
  "full_name": "<citizen's full name>",
  "email": "<citizen's email>",
  "phone_number": "<optional phone number>"
}

POST https://identity.city.digikraft-technologies.com/api/v1/accounts/recover/
Content-Type: application/json

{"email": "<citizen's email>"}

full_name is required (maximum 150 characters); email is required (maximum 320 characters); phone_number is optional (maximum 20 characters). Emails are trimmed and lowercased. Recovery accepts only email. Unknown fields, including passwords or staff roles, are rejected. JSON bodies are limited to 8 KiB.

HTTP status	App behaviour
202	Show “Check your email.” The generic response does not confirm an account exists or that email was delivered.
400	Correct the JSON body or show field `errors`; each field contains a list of `message`/`code` objects.
429	Ask the user to wait. Each endpoint allows 10 requests per IP/hour and 3 per email/hour.
503	Email delivery is unavailable. Offer retry; do not silently create a local account.

The 202 body contains detail and verification_required: true for both registration and recovery. Recovery links expire after 30 minutes and are single-use. Verification links expire after 24 hours. A successful password reset revokes central sessions and connected program tokens.

Email readiness and account safety

SSO administrators configure SMTP and send an explicit delivery test. Until email is enabled and configured, registration and recovery remain unavailable. A queued email is not proof of delivery. Never log verification links, recovery tokens, passwords or client secrets.

Do not auto-merge an existing program account by email or automatically grant staff roles. Follow explicit account linking and keep citizen access separate from operational authorization.