Authentication

Sign-in is handled by Authula, mounted at /api/v1/auth. It offers email and password, magic links and Google. This page covers the routes the clients use; the rest follow Authula's own documentation.

These routes are not wrapped in the response envelope.

Sign upCopy Anchor Link

POST /api/v1/auth/email-password/sign-up
Content-Type: application/json

{ "name": "Ada", "email": "[email protected]", "password": "at-least-8-characters" }

The password must be 8 to 128 characters. The address has to be confirmed by the emailed link before the account can sign in.

Sign inCopy Anchor Link

POST /api/v1/auth/email-password/sign-in
Content-Type: application/json

{ "email": "[email protected]", "password": "…" }

{
  "user": { "id": "…", "name": "Ada", "email": "[email protected]" },
  "session": {},
  "access_token": "…",
  "refresh_token": "…",
  "expires_at": "…",
  "expires_in": 900
}

Refresh the access tokenCopy Anchor Link

POST /api/v1/auth/token/refresh
Content-Type: application/json

{ "refresh_token": "…" }

It answers a new access_token and a new refresh_token. Both clients call it once when a request answers 401, then repeat that request.

Current userCopy Anchor Link

GET /api/v1/auth/me
Authorization: Bearer <access_token>

Answers { "user": …, "session": … }.

Sign outCopy Anchor Link

POST /api/v1/auth/sign-out
Authorization: Bearer <access_token>

RolesCopy Anchor Link

public.users.role is the application role. The only one with extra rights is super_user, which may write categories.