Authentication

You will use these two endpoints exactly once per session: register your user (only the first time), then log in to get a token. Every other endpoint in the API requires that token.

Tokens are valid for 7 days. Re-call POST /auth/login when yours expires.

Register

Use this endpoint to create a new Reconbanker user. You only need to call it once per person on your team.

POST /auth/register
Content-Type: application/json

Request body:

{
  "email": "you@example.com",
  "password": "your-password",
  "name": "Your Name"
}

• email - required.
• password - required.
• name - optional.

Responses:

• 201 Created

  { "id": "uuid", "email": "you@example.com" }

• 400 Bad Request - { "error": "email and password required" }

• 409 Conflict - { "error": "Email already exists" }

Register does not return a token. Call Login next.

Login

Use this endpoint to exchange your email and password for an API token.

POST /auth/login
Content-Type: application/json

Request body:

{
  "email": "you@example.com",
  "password": "your-password"
}

Responses:

• 200 OK

  {
    "token": "<jwt>",
    "user": {
      "id": "uuid",
      "email": "you@example.com",
      "name": "Your Name"
    }
  }

• 400 Bad Request - { "error": "email and password required" }

• 401 Unauthorized - { "error": "Invalid credentials" }

Send the returned token as Authorization: Bearer <token> on every protected request.