API authentication

Store tokens in platform secure storage and refresh the access token after an unauthorized response.

POST /api/v1/auth/login authenticates with e-mail and password and returns a token pair.
POST /api/v1/auth/refresh exchanges a refresh token for a new token pair.
POST /api/v1/auth/register creates an account and requires X-App-Token.
POST /api/v1/auth/forgot-password requests a reset e-mail and requires X-App-Token.
GET /api/v1/user returns the authenticated user.
DELETE /api/v1/user/delete requests account deletion.

Login

POST /api/v1/auth/login

{
  "email": "[email protected]",
  "password": "correct-horse-battery-staple"
}

The response contains accessToken, refreshToken, user details, tokenType=Bearer, and expiresIn. Store tokens in iOS Keychain or Android Keystore-backed storage.

Refresh

POST /api/v1/auth/refresh

{
  "refreshToken": "refresh-token-value"
}

Replace both stored tokens with the returned pair. Allow only one refresh operation at a time and replay queued requests once.

Registration and password recovery

POST /api/v1/auth/register and POST /api/v1/auth/forgot-password require X-App-Token. Registration requires an e-mail and password of at least 10 characters.

API authentication