Skip to main content
The Rakcha API uses JWT bearer tokens for authentication. To access protected endpoints, you must first obtain a token by submitting your credentials to the authentication endpoint. The token is then passed in the Authorization header on every subsequent request.

Obtaining a token

Send a POST request to /api/users/auth with your email address and password.

Endpoint

POST /api/users/auth

Request body

email
string
required
The email address associated with your Rakcha account.
password
string
required
Your account password.

Response fields

token
string
required
A signed JWT to use as your bearer token in subsequent requests.
user
object
required
The authenticated user object.

Example request

curl --request POST \
  --url https://rakcha.example.com/api/users/auth \
  --header 'Content-Type: application/json' \
  --data '{
    "email": "[email protected]",
    "password": "your-password"
  }'

Example response

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOjQyLCJlbWFpbCI6InVzZXJAZXhhbXBsZS5jb20iLCJyb2xlIjoiY2xpZW50IiwiaWF0IjoxNzExNTI4MDAwfQ.abc123",
  "user": {
    "id": 42,
    "email": "[email protected]",
    "role": "client"
  }
}

Using the token

Include the token in the Authorization header on every request that requires authentication:
curl --request GET \
  --url https://rakcha.example.com/api/films \
  --header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
Tokens are time-limited. If your token expires, repeat the authentication request to obtain a new one.

401 Unauthorized

If the Authorization header is missing, malformed, or contains an expired token, the API returns 401 Unauthorized:
{
  "message": "Invalid credentials."
}
To resolve a 401:
  • Confirm the Authorization header is present and formatted as Bearer <token>.
  • Check that the token has not expired — re-authenticate to obtain a fresh token.
  • Verify the email and password are correct for the target environment.

Build docs developers (and LLMs) love