Authentication API

Register an account

Request

fetch("http://localhost:8000/api/auth/register", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    username: "username",
    email: "username@domain.com",
    password: "password",
  }),
})
  .then((res) => res.json())
  .then((json) => console.log(json))
  .catch((err) => console.error("error:" + err));

• Upon successful registration, a user will receive an email to verify their account.

Response

{"message": "account created"}

Login

Request

fetch("http://localhost:8000/api/auth/login", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify(
     {"email":"email@domain.com","password":"password"}
  ),
})
  .then((res) => res.json())
  .then((json) => console.log(json))
  .catch((err) => console.error("error:" + err));

Response

{
  "accessToken": "JWTaccessToken",
  "refreshToken": "JWTRefreshToken"
}

Logout

Request

fetch("http://localhost:8000/api/auth/logout", {
  method: "POST",
  headers: {
    Authorization: "Bear JWTAccessToken",
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    refreshToken: "JWTRefreshToken",
  }),
})
  .then((res) => res.json())
  .then((json) => console.log(json))
  .catch((err) => console.error("error:" + err));

• The JWTAccessToken and JWTRefreshToken can be obtained from the /auth/login API endpoint or the /aut/refreshToken API endpoint

Response

none

Refresh Token

Request

fetch("http://localhost:8000/api/auth/refreshToken ", {
  method: "POST",
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify(
     {"refreshToken":"JWTRefreshToken"}
  ),
})
  .then((res) => res.json())
  .then((json) => console.log(json))
  .catch((err) => console.error("error:" + err));

• The JWTRefreshToken can be obtained from the /auth/login API endpoint API endpoint.
• A JWTRefreshToken can only be used once. For security purposes, If a JWTRefreshToken is used more than once, all tokens for the account belonging to that JWTRefreshToken will be revoked. As such, a user will be forced to log back in to regain access.

Response

{
  "accessToken": "JWTaccessToken",
  "refreshToken": "JWTRefreshToken"
}

Request Password Reset

Request

fetch("http://localhost:8000/api/auth/requestPasswordReset", {
  method: "POST",
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify(
     {"email":"email@domain.com"}
  ),
})
  .then((res) => res.json())
  .then((json) => console.log(json))
  .catch((err) => console.error("error:" + err));

Response

none

• This enpoint sends the account owner an email with a link to reset their password. The link includes a password reset token called token and a user id belonging to the account owner's account. This information can be used to reset the account's password using the /auth/resetAccountPassword endpoint.
• Password reset tokens expire after 1 hour, or when the password is reset; whichever happens first.

Reset Account Password

Request

fetch("http://localhost:8000/api/auth/resetAccountPassword", {
  method: "POST",
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify(
    {
       "passwordResetToken": "passwordResetToken",
       "newPassword": "newPassword",
       "userId": "userId"
    }
  ),
})
  .then((res) => res.json())
  .then((json) => console.log(json))
  .catch((err) => console.error("error:" + err));

• passwordResetToken and userId can be obtained using the /auth/requestPasswordReset endpoint.

Response

none

Verify Account Email

Request

fetch("http://localhost:8000/api/auth/verifyAccountEmail", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "verifyAccountEmailToken": "token",
    "userId": "id"
  }),
})
  .then((res) => res.json())
  .then((json) => console.log(json))
  .catch((err) => console.error("error:" + err));

• verifyAccountEmailToken and userId can be acquired from the user email sent to the user upon registration
• Note: a verifyAccountEmailToken is only valid for 1 hour or until the user verifies their account; whichever happens first.

Response

none