When you forget to turn off your passwordless personal hotspot on your iPhone and it says it has 1 connection.

Passwordless Unix login leading to a console menu. You can then FTP in for free and remove ~/.login . Boom ! Shell access! And I already had a superuser access from another "dialog" asking to confirm a dangerous action with the superuser's password. Boom! Root access !!

So, need to secure some requests.
I decided on going passwordless on the website but I want to have an API too.

I am reviewing auth0.
I am also not sure if I can secure the same endpoints as private and public differently, so the private is used by the backend with no auth and the public with auth.

Wold you guys help me with some reading material?

Has anybody on here used UNLOQ as a passwordless authentication mechanism. Keen to know if anybody in the devRant community has heard about (or has any opinions of) their recent buyout.