Skip to main content

​
Endpoints

​
Sign Up

POST /api/auth/signup
Body
FieldTypeRequiredDescription
usernamestringYesMin. 3 characters
emailstringYesValid email
passwordstringYesMin. 6 characters
referralCodestringNoOptional referral code
Response — 201 Created 
{
  "user": { "id": 1, "username": "john", "email": "john@example.com" },
  "accessToken": "eyJ..."
}

​
Login

POST /api/auth/login
Body
FieldTypeRequiredDescription
emailstringYesEmail or username
passwordstringYes—
Response — 200 OK 
{
  "user": { "id": 1, "username": "john", "email": "john@example.com" },
  "accessToken": "eyJ..."
}

​
Logout

POST /api/auth/logout
Clears session cookies. No body required.

​
Refresh Token

POST /api/auth/refresh
Uses the HTTP-only refresh token cookie to issue a new access token. Response — 200 OK 
{ "accessToken": "eyJ..." }

​
Check Auth Status

GET /api/auth/check
Returns the current authenticated user, or 401 if not authenticated.

​
Forgot Password

POST /api/auth/forgot-password
Body
FieldTypeRequired
emailstringYes
Sends a password reset link to the provided email.

​
OAuth — Google

GET /api/auth/google/url         # Get Google OAuth redirect URL
GET /api/auth/google/callback    # OAuth callback (handled by Google redirect)

​
OAuth — Twitter

GET /api/auth/twitter/url        # Get Twitter OAuth redirect URL
GET /api/auth/twitter/callback   # OAuth callback (handled by Twitter redirect)