Core Backend — Auth

Core Backend is the identity source of truth. Frontend calls these URLs directly in v1.

Explorer: https://backend-dev.bookdirect.live/public/docs/api#/

Base: https://backend-dev.bookdirect.live/public/api/v1/nellalink

Action	Winner	Full URL
Register	Core Backend	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/register
Login	Core Backend	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/login
Refresh	Core Backend	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/refresh
Logout	Core Backend	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/logout
Logout all	Core Backend	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/logout-all
Get user	Core Backend	GET https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/{user_uuid}
Reset password	Core Backend	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/reset-password
Reset validate	Core Backend	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/reset-password/validate
Verify email	Core Backend	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/verify-email-address

Playbook with request/response examples: Marketplace authentication.

Headers

Every call: x-api-key. Writes and most reads after login: Authorization: Bearer {access_token}.

JWT iss = nellalink. Secret: NELLALINK_JWT_SECRET on the host. Access tokens are short-lived (~30 minutes).

Middleware Backend using Core Backend auth

Middleware Backend must validate the same JWT (NELLALINK_USER_JWT_SECRET_KEY / decode with issuer nellalink) and then call Core Backend with x-api-key (service key) plus the user’s Bearer when writing entities as that user.

Middleware Backend must not mint a different user uuid and write Core Backend as them.

Optional Core Backend auth (not required for lodging v1 UI)

PIN, WebAuthn, Google OAuth, devices — see the live explorer. Do not block lodging launch on them.

If Middleware Backend adds auth later

Prefer the Middleware Backend route in frontend playbooks. These Core Backend URLs become “called by Middleware Backend.” Propose on /next.