FlagPulse

Appearance

Auth API ​

Base path: /api/auth. No authentication required — these endpoints establish the session cookie.

Register ​

POST /api/auth/register

Body

json
{
  "name": "Ada Lovelace",
  "email": "ada@example.com",
  "password": "••••••••",
  "confirmPassword": "••••••••"
}

All four fields are required. Fails with 400 if password !== confirmPassword, and 400 if the email is already registered. On success, sets the token cookie (httpOnly, 7-day expiry) and returns:

json
{
  "name": "Ada Lovelace",
  "email": "ada@example.com",
  "message": "User registered successfully"
}

Login ​

POST /api/auth/login

Body

json
{
  "email": "ada@example.com",
  "password": "••••••••"
}

Returns 404 if no user matches the email, 404 if the password doesn't match. On success, sets the same token cookie and returns:

json
{
  "name": "Ada Lovelace",
  "email": "ada@example.com",
  "message": "Login successful"
}

Logout ​

POST /api/auth/logout

Clears the token cookie. No body required.

json
{ "message": "Logged out" }

TIP

The frontend's Axios instance (services/api.ts) redirects to /login on any 401 response, so an expired/cleared cookie sends the user back to the login page automatically.