Skip to main content

​
Overview

Finanzapp supports two authentication methods: traditional email/password authentication and Google OAuth integration. All authenticated requests use PHP session-based authentication.

​
Authentication Methods

Email/Password

Traditional authentication with email and password

Google OAuth

Single sign-on using Google accounts

​
Email/Password Authentication

​
Login Endpoint

const xhr = new XMLHttpRequest();
const formData = new FormData();
formData.append('email', '[email protected]');
formData.append('password', 'SecurePass123');
formData.append('g-recaptcha-response', recaptchaToken);

xhr.open('POST', 'https://pro.finanzapp.es/app/auth/sendLogin.php', true);
xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');

xhr.onreadystatechange = function () {
  if (xhr.readyState === 4 && xhr.status === 200) {
    const data = JSON.parse(xhr.responseText);
    if (data.success) {
      console.log('Login successful:', data.user);
      // Session is automatically created server-side
    } else {
      console.error('Login failed:', data.message);
    }
  }
};

xhr.send(formData);

​
Request Parameters

​
email
string
required
User’s email address (must be a valid email format)
​
password
string
required
User’s password (minimum 8 characters, at least one uppercase letter and one number)
​
g-recaptcha-response
string
reCAPTCHA token for bot protection (optional but recommended)

​
Response

​
success
boolean
required
Indicates if the login was successful
​
message
string
Human-readable message about the operation
​
user
object
User information object (only included on success)

​
Example Response

Success
{
  "success": true,
  "message": "Login successful",
  "user": {
    "id": 123,
    "email": "[email protected]",
    "name": "John Doe",
    "url_image": "https://carefully-happy-quetzal.global.ssl.fastly.net/assets/avatars/01.jpeg",
    "accept_news": 1
  }
}
Error - Invalid Credentials
{
  "success": false,
  "message": "Email o contraseña incorrectas"
}
Error - Forbidden Access
{
  "success": false,
  "message": "Access denied"
}

​
Registration Endpoint

const formData = new FormData();
formData.append('nombre', 'John Doe');
formData.append('email', '[email protected]');
formData.append('password', 'SecurePass123');
formData.append('confirm-password', 'SecurePass123');
formData.append('terms', 'on');
formData.append('notifications', 'on'); // Optional

const xhr = new XMLHttpRequest();
xhr.open('POST', 'https://pro.finanzapp.es/app/auth/sendRegister.php', true);
xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');

xhr.onreadystatechange = function () {
  if (xhr.readyState === 4 && xhr.status === 200) {
    const data = JSON.parse(xhr.responseText);
    console.log(data);
  }
};

xhr.send(formData);

​
Request Parameters

​
nombre
string
required
User’s full name
​
email
string
required
User’s email address (must be unique and valid)
​
password
string
required
User’s password (minimum 8 characters, one uppercase, one number)
​
confirm-password
string
required
Password confirmation (must match password)
​
terms
string
required
Terms and conditions acceptance (must be “on”)
​
notifications
string
Newsletter subscription preference (“on” or empty)

​
Response

​
success
boolean
required
Indicates if the registration was successful
​
message
string
required
Human-readable message about the operation

​
Example Response

Success
{
  "success": true,
  "message": "Usuario registrado correctamente"
}
Error - Email Already Exists
{
  "success": false,
  "message": "El email ya está registrado"
}

​
Google OAuth Authentication

​
Login with Google

Finanzapp integrates with Google Sign-In for seamless authentication. 
function handleCredentialResponse(response) {
  fetch('https://pro.finanzapp.es/app/auth/google-callback-login.php', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      credential: response.credential
    })
  })
  .then(res => res.json())
  .then(data => {
    if (data.status === 'exists') {
      console.log('User already exists, logged in');
    } else if (data.status === 'inserted') {
      console.log('New user created and logged in');
    }
    window.location.href = "/Finanzapp/index.php";
  })
  .catch(error => console.error('Error:', error));
}

​
Request Parameters

​
credential
string
required
Google JWT credential token received from Google Sign-In

​
Response

​
status
string
required
Status of the operation: "exists" (existing user) or "inserted" (new user)
​
user
object
User information extracted from Google profile

​
Register with Google

Similar to login, but uses a redirect mode: 
<div id="g_id_onload"
  data-client_id="665269631824-25f2bkbj039grhjavj17pkqjsjdqj0jr.apps.googleusercontent.com"
  data-context="signup"
  data-ux_mode="redirect"
  data-login_uri="https://pro.finanzapp.es/app/auth/google-callback.php"
  data-auto_prompt="false">
</div>

​
Session Management

Once authenticated, Finanzapp creates a PHP session that persists across requests.

​
Session Data Structure

The server stores the following information in $_SESSION['user']: 
$_SESSION['user'] = [
    'id' => 123,
    'email' => '[email protected]',
    'name' => 'John Doe',
    'url_image' => 'https://carefully-happy-quetzal.global.ssl.fastly.net/assets/avatars/01.jpeg',
    'accept_news' => 1
];

​
Checking Authentication Status

Protected pages verify authentication using: 
if (empty($_SESSION['user']['id'])) {
    // User not authenticated - redirect to login
    header('Location: /app/login.php');
    exit;
}

​
Logout

​
Logout Endpoint

fetch('https://pro.finanzapp.es/app/auth/logout.php', {
  method: 'POST',
  headers: {
    'X-Requested-With': 'XMLHttpRequest'
  }
})
.then(response => response.json())
.then(data => {
  if (data.success) {
    console.log('Logged out successfully');
    window.location.href = '/app/login.php';
  }
})
.catch(error => console.error('Error:', error));

​
Endpoint Details

URL: POST /app/auth/logout.php Headers Required:
  • X-Requested-With: XMLHttpRequest

​
Response

​
success
boolean
required
Indicates if logout was successful
​
message
string
required
Human-readable message

​
Implementation

The logout endpoint (source: /home/daytona/workspace/source/app/auth/logout.php:18-21): 
session_unset();
session_destroy();

echo json_encode([
    'success' => true, 
    'message' => 'Sesión cerrada correctamente'
]);

​
Example Response

Success
{
  "success": true,
  "message": "Sesión cerrada correctamente"
}
Error - Invalid Request
{
  "success": false,
  "message": "Método no permitido"
}

​
Security Considerations

Important Security Notes:
  1. All authentication endpoints require the X-Requested-With: XMLHttpRequest header
  2. Direct browser access to API endpoints will return a 403 Forbidden error
  3. Passwords must meet complexity requirements (8+ chars, uppercase, number)
  4. reCAPTCHA integration prevents automated attacks
  5. Sessions are managed server-side with PHP’s built-in session handling

​
Password Requirements

Passwords must meet the following criteria (validated client-side and server-side):
  • Minimum 8 characters
  • At least one uppercase letter
  • At least one number
  • No maximum length limit
function validatePassword(password) {
  const passwordRegex = /^(?=.*[A-Z])(?=.*\d).{8,}$/;
  return passwordRegex.test(password);
}

​
Error Handling

All authentication endpoints return consistent error responses:
Error MessageCause
Acceso prohibidoMissing or invalid X-Requested-With header
Método no permitidoInvalid HTTP method (not POST)
Email o contraseña incorrectasInvalid login credentials
El email ya está registradoEmail already exists during registration
No hay una sesión activaSession expired or user not logged in
Error messages are returned in Spanish by default. The frontend uses the translation system for internationalization.

​
Next Steps

API Endpoints

Explore all available API endpoints

User Management

Learn about user profile and account management

Build docs developers (and LLMs) love

Get started for freeTalk to us