API Reference
Authentication
The API uses JWT Bearer tokens for authentication. Tokens are obtained via the login endpoint and must be included in all subsequent requests.
POST /auth/login
Authenticate with email and password. Returns a JWT token with userId, email, and role claims. The token is valid for 1 hour by default. In development mode, any email with password of at least 8 characters will succeed.
POST /auth/refresh
Refresh an expiring token before it expires. Requires a valid (not expired) JWT in the Authorization header. Returns a new token with a fresh expiry time.
GET /auth/me
Returns the decoded JWT payload for the current user. Useful for verifying token validity and checking the current user's role without decoding the JWT client-side.
POST /auth/logout
Blacklists the current token in Redis for its remaining time to live. Any subsequent request with the same token will be rejected. Logout is optional since tokens expire naturally.