The auth endpoints cover the full account lifecycle: registration, email confirmation, login, password reset, and sensitive-action verification. Most of these endpoints are public — they do not require a Bearer token.
Create account
POST /auth/create-account
No authentication required.
Request body
Full display name of the user.
Email address. Must be unique across all accounts.
Must match the password field exactly.
Example request
curl -X POST https://api.yourdomain.com/auth/create-account \
-H "Content-Type: application/json" \
-d '{
"name": "Ada Lovelace",
"email": "[email protected]",
"password": "s3cur3pass",
"password_confirmation": "s3cur3pass"
}'
Example response
{
"message": "Account created. Check your email to confirm your account."
}
Login
POST /auth/login
No authentication required.
AUTH_TOKEN in localStorage and include it in the Authorization header for all subsequent authenticated requests.
Request body
The registered email address.
Example request
curl -X POST https://api.yourdomain.com/auth/login \
-H "Content-Type: application/json" \
-d '{
"email": "[email protected]",
"password": "s3cur3pass"
}'
Example response
The response body is a plain JWT string:
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI2NDdmMWEyYjNjNGQ1ZTZmNzg5MDEyMzQiLCJpYXQiOjE3MTE5ODQwMDB9.abc123"
Confirm account
POST /auth/confirm-account
No authentication required.
Request body
The 6-digit confirmation token from the verification email.
Example request
curl -X POST https://api.yourdomain.com/auth/confirm-account \
-H "Content-Type: application/json" \
-d '{
"token": "482910"
}'
Example response
{
"message": "Account confirmed successfully."
}
Request new confirmation code
POST /auth/request-code
No authentication required.
Request body
The email address associated with the unconfirmed account.
Example request
curl -X POST https://api.yourdomain.com/auth/request-code \
-H "Content-Type: application/json" \
-d '{
"email": "[email protected]"
}'
Example response
{
"message": "A new confirmation code has been sent to your email."
}
Forgot password
POST /auth/forgot-password
No authentication required.
POST /auth/validate-token to check the token before prompting the user to enter a new password.
Request body
The email address associated with the account.
Example request
curl -X POST https://api.yourdomain.com/auth/forgot-password \
-H "Content-Type: application/json" \
-d '{
"email": "[email protected]"
}'
Example response
{
"message": "Password reset instructions have been sent to your email."
}
Validate password reset token
POST /auth/validate-token
No authentication required.
Request body
The password reset token from the reset email.
Example request
curl -X POST https://api.yourdomain.com/auth/validate-token \
-H "Content-Type: application/json" \
-d '{
"token": "482910"
}'
Example response
{
"message": "Token is valid."
}
Update password
POST /auth/update-password/:token
No authentication required. The reset token is passed as a URL path parameter.
POST /auth/validate-token.
Path parameters
The password reset token from the reset email. This is the same token validated by POST /auth/validate-token.
Request body
Must match the password field exactly.
Example request
curl -X POST https://api.yourdomain.com/auth/update-password/482910 \
-H "Content-Type: application/json" \
-d '{
"password": "newS3cur3pass",
"password_confirmation": "newS3cur3pass"
}'
Example response
{
"message": "Password updated successfully."
}
Get current user
GET /auth/user
Authentication required. Include your Bearer token in the Authorization header.
Example request
curl -X GET https://api.yourdomain.com/auth/user \
-H "Authorization: Bearer <your-token>"
Example response
{
"_id": "647f1a2b3c4d5e6f78901234",
"name": "Ada Lovelace",
"email": "[email protected]"
}
Response fields
Unique identifier for the user.
Full display name of the user.
Email address associated with the account.
Check password
POST /auth/check-password
Authentication required. Include your Bearer token in the Authorization header.
Request body
The current account password to verify.
Example request
curl -X POST https://api.yourdomain.com/auth/check-password \
-H "Authorization: Bearer <your-token>" \
-H "Content-Type: application/json" \
-d '{
"password": "s3cur3pass"
}'
Example response
{
"message": "Password is correct."
}
Update profile
PUT /auth/profile
Authentication required. Include your Bearer token in the Authorization header.
Request body
Updated email address. Must be unique across all accounts.
Example request
curl -X PUT https://api.yourdomain.com/auth/profile \
-H "Authorization: Bearer <your-token>" \
-H "Content-Type: application/json" \
-d '{
"name": "Ada Byron",
"email": "[email protected]"
}'
Example response
{
"message": "Profile updated successfully."
}
Change password (authenticated)
POST /auth/update-password
Authentication required. Include your Bearer token in the Authorization header.
Request body
The user’s current account password. Used to verify identity before the change is accepted.
The new password. Minimum 8 characters.
Must match the password field exactly.
Example request
curl -X POST https://api.yourdomain.com/auth/update-password \
-H "Authorization: Bearer <your-token>" \
-H "Content-Type: application/json" \
-d '{
"current_password": "s3cur3pass",
"password": "newStr0ngPass!",
"password_confirmation": "newStr0ngPass!"
}'
Example response
{
"message": "Password updated successfully."
}
