Auth

Registration, login, session refresh, and the self-service and invite-based account-joining flows. See Authentication for the general JWT flow this powers.

POST/auth/register

Create a new account (tenant) plus its first user as Owner. Body: accountName, fullName, email, password, referralCode?. Returns the account, user, and a token pair.

Public - no auth required.

POST/auth/login

Email/password login. Body: email, password. Returns the user and a token pair.

Public - rate-limited to 10/min/IP.

POST/auth/refresh

Exchange a valid refresh token for a new access token.

Public - rate-limited to 20/min/IP.

GET/auth/me

The current authenticated user.

POST/auth/social

Body: idToken (a Firebase ID token from Google/Facebook sign-in). Same response shape as login/register.

Public - rate-limited to 10/min/IP.

POST/invites/accept

Accept an email or SMS invite to join an existing account, attaching the accepting user to it.

Public - rate-limited to 10/min/IP.