Authentication¶

The CurioPay API uses JWT (JSON Web Tokens) for authentication.

Obtaining a Token¶

Register a new user¶

POST /auth/register
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "securePassword123",
  "firstName": "John",
  "lastName": "Doe"
}

POST /auth/login
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "securePassword123"
}

Response:

{
  "success": true,
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "user": {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "email": "user@example.com",
      "firstName": "John",
      "lastName": "Doe",
      "role": "USER"
    }
  },
  "message": "Login successful"
}

Using the Token¶

Include the token in the Authorization header for protected endpoints:

GET /users/profile
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Token Refresh¶

When the access token expires, use the refresh token to obtain a new one:

POST /auth/refresh
Content-Type: application/json

{
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Email Verification¶

New users need to verify their email address:

GET /auth/verify-email?token=verification-token-sent-via-email

Password Reset¶

Request a password reset:

POST /auth/forgot-password
Content-Type: application/json

{
  "email": "user@example.com"
}

Reset the password using the token sent via email:

POST /auth/reset-password
Content-Type: application/json

{
  "token": "reset-token-from-email",
  "newPassword": "newSecurePassword123"
}

Logout¶

Invalidate the current token:

POST /auth/logout
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...