Authenticate user/password against custom user table

[marcus-at-localhost]

My question is about V8, but might be valid for V9 as well.

I want to verify a user of my app, against a list of users, stored and administered in Directus.
Initially I wanted to use directus_users table and the POST /:project/auth/authenticate endpoint, but it seems weird to mix Directus users with this third party user table.

The docs say:

Users vs. Directus Users
Because it comes with auth, permissions, and other features out-of-the-box, many developers want to repurpose Directus Users to manage "users" within their proprietary client application. While this may work in some projects, we recommend creating your own users collection to avoid issues.

https://v8.docs.directus.io/guides/modules.html#user-directory

So I created a new collection called members with a text field for the unique username/email and a password field.

After reading the docs up and down and search the old issues, I came up with this strategy to verify a user via the API (using the access_token of the Directus Admin):

GET {{url}}/:project/items/members?single=1&filter[email][eq]=test@example.com

{
    "data": {
        "id": 2,
        "status": "published",
        "sort": null,
        "owner": 1,
        "created_on": "2021-08-17T16:43:54+00:00",
        "modified_on": "2021-08-17T16:43:54+00:00",
        "notice": null,
        "test": null,
        "email": "test@example.com",
        "password": "$2y$10$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    },
    "public": true
}

And in a second step I would post the hash along with the password

POST {{url}}/:project/utils/hash/match

Body:

{
  "hash": "$2y$10$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "string": "123456"
}

Result:

{
    "data": {
        "valid": true
    },
    "public": true
}

Is that the way to do it? I found it nowhere documented.
Is there a better way, with just one call?

Thanks for your input!

[rijkvanzanten]

That'd be the way to do it!

That being said, that recommendation no longer applies starting in v9. v9 added the ability to add custom fields to the system collections, negating the downsides of using that for your own app's users 👍🏻