Skip to main content

​
Endpoints

​
POST /api/v1/auth/login

Authenticates a user and returns a JWT access token. Sets a refresh token as an HTTP-only cookie. Request:
Response: { "access_token": "eyJ...", "token_type": "bearer" }

​
POST /api/v1/auth/signup

Creates a new institution with an admin user. Returns JWT for auto-login. Request:
Response: { "access_token": "eyJ...", "token_type": "bearer", "university_id": "uuid", "user_id": "uuid" } Creates: University + User (admin role) + default ReportingPeriod. Sends welcome email.

​
GET /api/v1/auth/me

Returns the authenticated user’s profile including role, tier, and university name.

​
POST /api/v1/auth/refresh

Exchanges a refresh token cookie for a new access token.

​
POST /api/v1/auth/logout

Clears the refresh token cookie.

​
POST /api/v1/auth/forgot-password

Generates a reset token (1-hour TTL) and sends an email. Always returns success to prevent enumeration. Request: { "email": "user@school.edu" }

​
POST /api/v1/auth/reset-password

Validates the reset token and updates the user’s password hash. Request: { "token": "...", "new_password": "newpass123" }

​
GET /api/v1/auth/conferences

Public endpoint (no auth required). Returns all conferences for the signup form dropdown.