This API should be called after the user finishes the Auth0 authorization.
So the frontend should be able to obtain an Auth0 token at that point. The
API should be called with this token in the Authorization
header, in the
format like Authorization: Bearer <token>
.
The API will call an Auth0 API to query user information with the token. If it successfully gets it, it means the token is valid. Then the API will either:
depending on whether a user with the same identity exists in our system.
If everything is okay, the API will return a token which can then be used as an identification to call other APIs. The return format is intentionally designed to keep the same as password login API.