Authentication & profiles
The authentication module is the identity boundary for the platform. It preserves SimpleJWT-compatible access/refresh behavior and PBKDF2-SHA256 password verification while keeping OTP state and revocations in Redis when configured.
Routes
| Route | Method | Purpose |
|---|---|---|
/api/v1/auth/register/ | POST | Create registration state |
/api/v1/auth/register/verify/ | POST | Confirm registration OTP |
/api/v1/auth/login/ | POST | Exchange credentials for tokens |
/api/v1/auth/token/refresh/ | POST | Refresh access token |
/api/v1/auth/logout/ | POST | Revoke/logout current token state |
/api/v1/auth/password-reset/ | POST | Start reset verification |
/api/v1/auth/change-password/ | POST | Change authenticated password |
/api/v1/auth/profile/ | GET, PATCH | Read/update profile |
/api/v1/auth/profile/image/ | POST, DELETE | Manage MinIO/S3 profile image |
/api/v1/auth/google/ | POST | Exchange Google token path |
/api/v1/auth/phone/send-otp/ | POST | Send phone verification OTP |
/api/v1/auth/phone/verify/ | POST | Verify phone OTP |
Bearer token requirement
Authorization: Bearer <access-token>Profile and administrative routes obtain identity from the token context, never from a client-provided user_id. Passwords, OTPs, JWTs, and provider credentials must never appear in logs or error payloads.
Last updated on