Auth Endpoints

POST /v1/auth/signup

Create a new platform account. Request body:

{
  "email": "you@example.com",
  "password": "your-password",
  "name": "Your Name"
}

Response 201:

{
  "data": {
    "id": "usr_abc123",
    "email": "you@example.com",
    "name": "Your Name",
    "totpEnabled": false
  }
}

Log in

POST /v1/auth/login

Authenticate with email + password. On success, sets a session cookie. Request body:

{
  "email": "you@example.com",
  "password": "your-password",
  "totpCode": "123456"
}

The totpCode field is required only if MFA is enabled on the account. Response 200:

{
  "data": {
    "id": "usr_abc123",
    "email": "you@example.com",
    "name": "Your Name",
    "totpEnabled": true
  }
}

Rate limiting: After 10 failed attempts, the account is locked for 30 minutes.

POST /v1/auth/logout

Invalidates the current session. No request body needed. Response 204: No content.