vkovalov-backend API

Creates an account with the role user and returns the stored user. It does not log the user in.

Request body

Example

curl -X POST https://api.vkovalov.dev/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"ada@example.com","password":"correct horse battery","first_name":"Ada"}'

Response 201

{
  "id": "3f1c2a9e-6f0b-4c1d-9a55-0d6c1f2b7e10",
  "email": "ada@example.com",
  "first_name": "Ada",
  "role": "user",
  "is_totp_enabled": false,
  "is_active": true,
  "created_at": "2026-10-02T09:30:00Z",
  "updated_at": "2026-10-02T09:30:00Z"
}

Status codes

Checks the email and password. The response has one of two shapes, depending on whether the account has 2FA enabled.

Request body

Example

curl -X POST https://api.vkovalov.dev/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"ada@example.com","password":"correct horse battery"}'

Response 200, 2FA not enabled

{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "requires_2fa": false,
  "user": { "id": "3f1c2a9e-...", "email": "ada@example.com", "role": "user", ... }
}

Response 200, 2FA enabled

{
  "requires_2fa": true,
  "pre_auth_token": "eyJhbGciOiJIUzI1NiIs..."
}

Status codes

Second login step for accounts with 2FA enabled. Checks the 6-digit code and returns the access token.

Request body

Example

curl -X POST https://api.vkovalov.dev/auth/2fa/verify \
  -H "Content-Type: application/json" \
  -d '{"user_id":"3f1c2a9e-6f0b-4c1d-9a55-0d6c1f2b7e10","code":"492817"}'

Response 200

{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "requires_2fa": false,
  "user": { "id": "3f1c2a9e-...", "email": "ada@example.com", "role": "user", ... }
}

Status codes

Confirms that the access token is valid and returns the ID of the user it belongs to.

Example

curl https://api.vkovalov.dev/profile \
  -H "Authorization: Bearer <access_token>"

Response 200

{
  "message": "Access granted to protected route!",
  "user_id": "3f1c2a9e-6f0b-4c1d-9a55-0d6c1f2b7e10"
}

Status codes