Skip to content
Reference

Endpoints

Every route auth.setup(app) mounts. They all appear in your app's own /docs page too, documented and ready to try.

Authentication#

POST/token

Log in; returns access + refresh tokens, sets the cookie when enabled

POST/token/refresh

Exchange a refresh token for a new access token

POST/users

Register a new user; username and email must be unique

GET/users/me

The current authenticated user's profile

POST/logout

Clear the authentication cookie

POST/logout/all

Revoke every token for the current user, on all devices

Account flows#

POST/password/forgot

Issue a reset token; always 200, delivered via your hook

POST/password/reset

Set a new password with a single-use reset token

POST/password/change

Change the logged-in user's password; revokes old sessions

POST/email/verify/request

Issue an email verification token for the logged-in user

POST/email/verify

Confirm an email address with a verification token

Role management#

GET/roles/

List all roles

POST/roles/admin

Create a new role

GET/roles/{role_id}

Get a role by ID

PUT/roles/{role_id}admin

Update a role

DELETE/roles/{role_id}admin

Delete a role

POST/roles/assign/{user_id}/{role_id}admin

Assign a role to a user

DELETE/roles/assign/{user_id}/{role_id}admin

Remove a role from a user

GET/roles/user/{user_id}

List a user's roles