Core — Auth

Core is the identity source of truth. Frontend calls these URLs directly in v1.

Explorer: https://backend-dev.bookdirect.live/public/docs/api#/

Base: https://backend-dev.bookdirect.live/public/api/v1/nellalink

Action	Winner	Full URL
Register	Core	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/register
Login	Core	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/login
Refresh	Core	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/refresh
Logout	Core	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/logout
Logout all	Core	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/logout-all
Get user	Core	GET https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/{user_uuid}
Reset password	Core	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/reset-password
Reset validate	Core	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/reset-password/validate
Verify email	Core	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/verify-email-address

Playbook with request/response examples: Sign up and login.

Headers

Every call: x-api-key. Writes and most reads after login: Authorization: Bearer {access_token}.

JWT iss = nellalink. Secret: NELLALINK_JWT_SECRET on the host. Access tokens are short-lived (~30 minutes).

Middleware using Core auth

Middleware must validate the same JWT (NELLALINK_USER_JWT_SECRET_KEY / decode with issuer nellalink) and then call Core with x-api-key (service key) plus the user’s Bearer when writing entities as that user.

Middleware must not mint a different user uuid and write Core as them.

Optional Core auth (not required for lodging v1 UI)

PIN, WebAuthn, Google OAuth, devices — see the live explorer. Do not block lodging launch on them.

If Middleware adds auth later

Prefer the Middleware route in frontend playbooks. These Core URLs become “called by Middleware.” Propose on /next.