Account Access

Login with account-state checks.

Account flows use the same typed service contracts as the shared API, with explicit state messages for unconfirmed, frozen, deleted, and invalid-token cases.