> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spn.wtf/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth

> Authentication endpoints — sign up, login, token refresh, OAuth

## Endpoints

### Sign Up

```http theme={null}
POST /api/auth/signup
```

**Body**

| Field          | Type   | Required | Description            |
| -------------- | ------ | -------- | ---------------------- |
| `username`     | string | Yes      | Min. 3 characters      |
| `email`        | string | Yes      | Valid email            |
| `password`     | string | Yes      | Min. 6 characters      |
| `referralCode` | string | No       | Optional referral code |

**Response** — `201 Created`

```json theme={null}
{
  "user": { "id": 1, "username": "john", "email": "john@example.com" },
  "accessToken": "eyJ..."
}
```

***

### Login

```http theme={null}
POST /api/auth/login
```

**Body**

| Field      | Type   | Required | Description       |
| ---------- | ------ | -------- | ----------------- |
| `email`    | string | Yes      | Email or username |
| `password` | string | Yes      | —                 |

**Response** — `200 OK`

```json theme={null}
{
  "user": { "id": 1, "username": "john", "email": "john@example.com" },
  "accessToken": "eyJ..."
}
```

***

### Logout

```http theme={null}
POST /api/auth/logout
```

Clears session cookies. No body required.

***

### Refresh Token

```http theme={null}
POST /api/auth/refresh
```

Uses the HTTP-only refresh token cookie to issue a new access token.

**Response** — `200 OK`

```json theme={null}
{ "accessToken": "eyJ..." }
```

***

### Check Auth Status

```http theme={null}
GET /api/auth/check
```

Returns the current authenticated user, or `401` if not authenticated.

***

### Forgot Password

```http theme={null}
POST /api/auth/forgot-password
```

**Body**

| Field   | Type   | Required |
| ------- | ------ | -------- |
| `email` | string | Yes      |

Sends a password reset link to the provided email.

***

### OAuth — Google

```http theme={null}
GET /api/auth/google/url         # Get Google OAuth redirect URL
GET /api/auth/google/callback    # OAuth callback (handled by Google redirect)
```

***

### OAuth — Twitter

```http theme={null}
GET /api/auth/twitter/url        # Get Twitter OAuth redirect URL
GET /api/auth/twitter/callback   # OAuth callback (handled by Twitter redirect)
```