Authentication

Authenticate using email/password or PIN (for POS terminals). All requests require a Bearer token.

POST/api/auth/register

Register a new organization

{
  "email": "string (email)",
  "password": "string (min 8 chars)",
  "firstName": "string",
  "lastName": "string",
  "organizationName": "string",
  "organizationSlug": "string (optional)"
}

Response

{
  "user": {
    "id": "uuid",
    "email": "user@example.com",
    "firstName": "John",
    "lastName": "Doe"
  },
  "organization": {
    "id": "uuid",
    "name": "My Business",
    "slug": "my-business"
  },
  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
  "refreshToken": "dGhpcyBpcyBhIHJlZnJlc2g..."
}
POST/api/auth/login

Login with email and password

{
  "email": "string (email)",
  "password": "string"
}

Response

{
  "user": {
    "id": "uuid",
    "email": "user@example.com",
    "role": "owner"
  },
  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
  "refreshToken": "dGhpcyBpcyBhIHJlZnJlc2g..."
}
POST/api/auth/pin-login

Quick login via PIN (POS terminals)

{
  "pin": "string (4-6 digits)",
  "locationId": "uuid"
}

Response

{
  "user": {
    "id": "uuid",
    "firstName": "Jane",
    "role": "employee"
  },
  "accessToken": "eyJhbGciOiJIUzI1NiIs..."
}
POST/api/auth/refresh

Refresh authentication token

{
  "refreshToken": "string"
}

Response

{
  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
  "refreshToken": "dGhpcyBpcyBhIG5ldyBy..."
}
POST/api/auth/logout

Logout user

{
  "refreshToken": "string (optional)"
}

Response

{
  "success": true
}
POST/api/auth/set-pin

Set user PIN

{
  "pin": "string (4-6 digits)"
}

Response

{
  "success": true,
  "message": "PIN set successfully"
}
POST/api/auth/users/{userId}/reset-pin

Reset user PIN (Admin/Owner only)

{}

Response

{
  "success": true,
  "message": "PIN has been reset"
}