Auth

All endpoints are prefixed with /api/auth. Requests and responses use Content-Type: application/json. Endpoints that require authentication expect an Authorization: Bearer <accessToken> header.

Only @calpoly.edu email addresses are accepted.

Request body

string

required

A valid @calpoly.edu email address.

password

string

required

Account password. Must be 8–30 characters.

username

string

required

Display name shown on the user’s profile. Must be 2–30 characters.

Response — 201 Created

success

boolean

true on success.

message

string

Human-readable confirmation, e.g. "Account created. Please check your email for the verification code."

data

object

Show properties

integer

Unique user ID.

string

Registered email address.

name

string

Username supplied at registration.

Error responses

Status	Condition
`400`	Missing or invalid fields, non-`@calpoly.edu` email, password/username length out of range
`409`	Email is already registered

Example

curl -X POST http://localhost:3000/api/auth/signup \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "password": "SecurePass123",
    "username": "musty_mustang"
  }'

Request body

string

required

Registered email address.

password

string

required

Account password.

Response — 200 OK

success

boolean

true on success.

data

object

Show properties

accessToken

string

Short-lived JWT used to authenticate subsequent requests.

refreshToken

string

Long-lived token used to obtain a new access token.

user

object

Show properties

integer

User ID.

string

User’s email address.

name

string

Display name.

auraPoints

integer

Total aura points earned.

streak

integer

Current consecutive-day completion streak.

Error responses

Status	Condition
`400`	Missing `email` or `password` field
`401`	Invalid email or password

Example

curl -X POST http://localhost:3000/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "password": "SecurePass123"
  }'

POST /api/auth/verify

Verify the OTP code that was emailed after signup. Returns session tokens on success, making the account active.

Request body

string

required

Email address that received the OTP.

token

string

required

The OTP code from the verification email. Must be 4–8 characters.

Response — 200 OK

success

boolean

true on success.

message

string

"Email verified successfully."

data

object

Show properties

accessToken

string

Short-lived JWT.

refreshToken

string

Long-lived refresh token.

user

object

Show properties

integer

User ID.

string

Email address.

name

string

Display name.

auraPoints

integer

Total aura points.

streak

integer

Current streak.

Error responses

Status	Condition
`400`	Invalid or expired OTP code
`404`	User record not found after verification

Example

curl -X POST http://localhost:3000/api/auth/verify \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "token": "123456"
  }'

POST /api/auth/resend

Resend the signup verification OTP to the provided email address.

Request body

string

required

Email address to resend the verification code to.

Response — 200 OK

success

boolean

true on success.

message

string

"A new code has been sent to your email."

Error responses

Status	Condition
`400`	Missing `email` or Supabase could not send the code

Example

curl -X POST http://localhost:3000/api/auth/resend \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]"}'

POST /api/auth/change-password

Change the password for the currently authenticated user. The current password is verified before applying the update.

Auth required: Yes — include Authorization: Bearer <accessToken>.

Request body

oldPassword

string

required

The user’s current password.

newPassword

string

required

The desired new password. Must be 8–30 characters.

Response — 200 OK

success

boolean

true on success.

message

string

"Password updated successfully."

Error responses

Status	Condition
`400`	`oldPassword` is incorrect, or `newPassword` length is out of range
`401`	Missing or invalid Bearer token

Example

curl -X POST http://localhost:3000/api/auth/change-password \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <accessToken>" \
  -d '{
    "oldPassword": "SecurePass123",
    "newPassword": "EvenBetter456"
  }'

Overview

Endpoints

Request body

Response — 201 Created

Error responses

Example

Request body

Response — 200 OK

Error responses

Example

POST /api/auth/verify

Request body

Response — 200 OK

Error responses

Example

POST /api/auth/resend

Request body

Response — 200 OK

Error responses

Example

POST /api/auth/change-password

Request body

Response — 200 OK

Error responses

Example

Build docs developers (and LLMs) love

Overview

Endpoints

​POST /api/auth/signup

​Request body

​Response — 201 Created

​Error responses

​Example

​POST /api/auth/login

​Request body

​Response — 200 OK

​Error responses

​Example

​POST /api/auth/verify

​Request body

​Response — 200 OK

​Error responses

​Example

​POST /api/auth/resend

​Request body

​Response — 200 OK

​Error responses

​Example

​POST /api/auth/change-password

​Request body

​Response — 200 OK

​Error responses

​Example

Build docs developers (and LLMs) love

POST /api/auth/signup

Request body

Response — 201 Created

Error responses

Example

POST /api/auth/login

Request body

Response — 200 OK

Error responses

Example

POST /api/auth/verify

Request body

Response — 200 OK

Error responses

Example

POST /api/auth/resend

Request body

Response — 200 OK

Error responses

Example

POST /api/auth/change-password

Request body

Response — 200 OK

Error responses

Example