Authentication

Authentication Methods

The API uses Bearer Token for authentication. There are two methods for obtaining and using a token:

1. Session Token

Obtain a token via the Login endpoint:

curl -X POST "https://example.com/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "your-password"}'

Response:

{
  "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
  "user": { "id": 1, "email": "user@example.com" }
}

2. API Key

API keys are permanent and can be created in the admin panel.

Sending the Token

The token must be sent in the Authorization header as follows:

Authorization: Bearer {your-token}

You can also use the X-Auth-Token header:

X-Auth-Token: {your-token}

Public Endpoints (No Token Required)

Phone Login

To login with a phone number:

# Step 1: Send OTP
curl -X POST "https://example.com/api/auth/send-otp" \
  -H "Content-Type: application/json" \
  -d '{"phone": "09123456789"}'

# Step 2: Login with OTP
curl -X POST "https://example.com/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"phone": "09123456789", "otp": "123456"}'

Logout

curl -X POST "https://example.com/api/auth/logout" \
  -H "Authorization: Bearer {token}"

Phone Number Change

To change the authenticated user's phone number:

# Step 1: Send OTP to new number
curl -X POST "https://example.com/api/auth/phone/change/send-otp" \
  -H "Authorization: Bearer {token}" \
  -H "Content-Type: application/json" \
  -d '{"phone": "09123456789"}'

# Step 2: Verify OTP
curl -X POST "https://example.com/api/auth/phone/change/verify-otp" \
  -H "Authorization: Bearer {token}" \
  -H "Content-Type: application/json" \
  -d '{"phone": "09123456789", "otp": "123456"}'

Rate Limiting