Token-based authentication. Sign up, login to receive tokens, and include the idToken as a Bearer token in all authenticated requests.
POST /auth/signup â POST /auth/login â use the returned idToken as Authorization: Bearer <idToken>. Tokens expire in 1 hour. Use /auth/refresh to get new tokens./auth/signupRegister a new user account. After signup, the account is immediately active â no email verification step required.
emailstring*User's email address. Must be unique.passwordstring*Password. Must include uppercase, lowercase, number, and special character.firstNamestring*User's first name.lastNamestring*User's last name.messagestringSuccess confirmation message.userIdstringUnique user identifier (UUID).apiKeystringAPI key for x-api-key header.// POST /auth/signup
{
"email": "user@example.com",
"password": "SecurePass1!",
"firstName": "John",
"lastName": "Doe"
}/auth/loginAuthenticate with email and password to receive JWT tokens. The idToken is used for API authentication, the accessToken for Cognito operations, and the refreshToken to get new tokens.
emailstring*Registered email address.passwordstring*Account password.idTokenstringJWT token for API authentication (Bearer token). Expires in 1 hour.accessTokenstringCognito access token.refreshTokenstringToken to refresh expired tokens without re-login.apiKeystringAPI key for x-api-key header.firstNamestringUser's first name.lastNamestringUser's last name.emailstringUser's email.// POST /auth/login
{
"email": "user@example.com",
"password": "SecurePass1!"
}/auth/refreshGet new tokens using a valid refresh token. Use this when your idToken expires (after 1 hour) instead of re-logging in.
refreshTokenstring*The refresh token from login.idTokenstringNew JWT token for API authentication.accessTokenstringNew Cognito access token.// POST /auth/refresh
{
"refreshToken": "eyJhbGciOi..."
}/auth/logoutInvalidate the current session. Requires the access token to revoke.
accessTokenstring*The access token to invalidate.messagestringLogout confirmation.// POST /auth/logout
// Authorization: Bearer <idToken>
{
"accessToken": "eyJhbGciOi..."
}