# Authentication

Canonical page: https://docs.ovok.com/python-sdk/namespaces/auth

`ovok.auth` signs users in and out, registers patients and practitioners, and manages the
signed-in account. Use it on a client built without `client_secret`; a machine client
authenticates on its own (see [Get started](/python-sdk/getting-started)).

## Sign a user in [#sign-a-user-in]

`login` returns `SignedIn`, or `MfaRequired` when the account needs a one-time code. The
client stores the session and refreshes it before it expires.

```python
from ovok_sdk import Ovok

ovok = Ovok("https://api.sandbox.ovok.com", "your-tenant")

result = ovok.auth.login(profile_type="Patient", email=email, password=password)
if result.status == "mfa-required":
    result = ovok.auth.verify_mfa(result.challenge, code)

print(result.session.profile.reference)
```

For Apple or Google sign-in, pass the provider's result to `social_login`; this needs
`client_id` in the client config.

## Register an account [#register-an-account]

`register` signs a new patient in, unless the project routes the email to a clinician
invitation. The password confirmation is checked locally and never sent.

```python
from ovok_sdk import PatientRegistration

result = ovok.auth.register(
    PatientRegistration(
        email="ada@example.com",
        password=password,
        password_confirm=password,
        name="Ada",
        surname="Lovelace",
    )
)
if result.status == "clinician-invite":
    print("Check your email for the clinician invitation.")
```

Use `register_practitioner` with a `Registration` for practitioners.

## Manage passwords and sessions [#manage-passwords-and-sessions]

```python
ovok.auth.change_password(old_password=old, new_password=new)
ovok.auth.reset_password(email="ada@example.com", profile_type="Patient")

for session in ovok.auth.sessions.list():
    print(session)
ovok.auth.sessions.revoke("other")
```

`logout` ends the session on the server and always clears it locally.

## API reference [#api-reference]

See [`ovok_sdk.resources.auth`](/python-sdk/reference/resources/auth),
[`ovok_sdk.resources.auth_sessions`](/python-sdk/reference/resources/auth_sessions)
and [`ovok_sdk.resources.registration`](/python-sdk/reference/resources/registration)
for every method, parameter and error.