# Auth & Email Verification Endpoints {#auth--email-verification-endpoints}


Authentication, registration, password management, and email verification endpoints.


## Base Path {#base-path}


```
/api/auth
```


## Authentication {#authentication}



### Login {#login}


```
POST /api/auth/login
```

**Request Body:**

```json
{
  "email": "user@example.com",
  "password": "your-password"
}
```

**Response `200 OK`:**

```json
{
  "user": { "id": "uuid", "email": "user@example.com", "name": "John" },
  "token": "jwt-access-token",
  "refresh_token": "jwt-refresh-token"
}
```


### Register {#register}


```
POST /api/auth/register
```

**Request Body:**

```json
{
  "user": {
    "firstName": "John",
    "lastName": "Doe",
    "email": "john@example.com",
    "password": "SecureP@ss123"
  },
  "password": "SecureP@ss123",
  "confirmPassword": "SecureP@ss123"
}
```


### Refresh Token {#refresh-token}


```
POST /api/auth/refresh-token
```

**Request Body:**

```json
{
  "refresh_token": "jwt-refresh-token"
}
```


### Check Auth {#check-auth}


```
GET /api/auth/check
Authorization: Bearer {token}
```

Validates the current JWT token.


## Password Management {#password-management}



### Request Password Reset {#request-password-reset}


```
POST /api/auth/reset-password
```

**Request Body:**

```json
{
  "email": "user@example.com"
}
```


### Change Password {#change-password}


```
POST /api/auth/change-password
Authorization: Bearer {token}
```

**Request Body:**

```json
{
  "currentPassword": "old-password",
  "newPassword": "new-password",
  "confirmPassword": "new-password"
}
```


## Email Verification {#email-verification}



### Send Verification Email {#send-verification-email}


```
POST /api/auth/email/verify/resend-verification-code
Authorization: Bearer {token}
```


### Verify Email {#verify-email}


```
POST /api/auth/email/verify/code
```

**Request Body:**

```json
{
  "email": "user@example.com",
  "code": 123456
}
```


## Email Check {#email-check}



### Check Email Availability {#check-email-availability}


```
POST /api/email-check/validate
```

**Request Body:**

```json
{
  "email": "check@example.com"
}
```


## Email Reset {#email-reset}



### Request Email Change {#request-email-change}


```
POST /api/email-reset/request-change
Authorization: Bearer {token}
```

**Request Body:**

```json
{
  "email": "new@example.com"
}
```


### Verify Email Change {#verify-email-change}


```
POST /api/email-reset/verify
Authorization: Bearer {token}
```


## Social Auth {#social-auth}



### Google OAuth {#google-oauth}


```
GET /api/auth/google
GET /api/auth/google/callback
```


### GitHub OAuth {#github-oauth}


```
GET /api/auth/github
GET /api/auth/github/callback
```


### Microsoft OAuth {#microsoft-oauth}


```
GET /api/auth/microsoft
GET /api/auth/microsoft/callback
```


### Facebook OAuth {#facebook-oauth}


```
GET /api/auth/facebook
GET /api/auth/facebook/callback
```


## Security {#security}


- Passwords require minimum 8 characters, uppercase, lowercase, number, special character
- Failed login attempts are rate-limited
- JWT tokens have configurable expiration
- Refresh tokens are single-use
- Email verification codes expire after 10 minutes


## Related Pages {#related-pages}


- [JWT Authentication](https://sourcey-gauzy.pages.dev/authentication/jwt-authentication/index.md) — JWT details
- [Social Auth](https://sourcey-gauzy.pages.dev/authentication/social-auth/index.md) — OAuth providers
- [Password Security](https://sourcey-gauzy.pages.dev/security/password-security/index.md) — password policies