How to build: Marketplace authentication

implemented Guest /auth/sign-in, /auth/sign-up, /auth/forgot-password, /auth/reset-password, /account.

Layer winners: Core Backend for register, login, refresh, logout, password reset, verify email, profile.

Sign up → Login → store access_token + uuid → search or account
Forgot password → email token → validate → login

Next app: app/(guest)/auth/*, app/(guest)/account/page.tsx. Explorer: Core Backend — Auth users. ENV / Metadata Catalog.

---

Sign In

Core Backend · winnerimplemented

Call this API

POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/login

Route: /auth/sign-in

x-api-key: {NEXT_PUBLIC_API_KEY}
Content-Type: application/json

{
  "email": "guest@example.com",
  "password": "choose-a-strong-password"
}

Store data.access_token and data.uuid. The Next client is services/auth.ts → API_ROUTES.AUTH.SIGNIN.

---

Sign Up

Core Backend · winnerimplemented

POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/register

Route: /auth/sign-up

{
  "email": "guest@example.com",
  "password": "choose-a-strong-password",
  "password_confirmation": "choose-a-strong-password",
  "name": "Ada Guest",
  "username": "ada_guest"
}

Register does not return a JWT. Next: login.

---

Verify Email

Core Backend · winnerpartial

POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/verify-email-address

POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/verify-email-address/validate

Wired in config/api-routes.ts. Marketplace has no dedicated /verify-email page yet (Extranet does: /extranet/auth/verify-email).

---

Forgot Password

Core Backend · winnerimplemented

POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/reset-password

Route: /auth/forgot-password

Body used by the app: { "email_address": "guest@example.com" }.

Finish on /auth/reset-password:

POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/reset-password/validate

---

Profile / Edit Profile / Change Password

Core Backend · winnerimplemented

GET https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/{user_uuid}

PATCH https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/{user_uuid}

Route: /account

{user_uuid} must be the session uuid. Core Backend must deny GET/PATCH of another uuid on the public key.

Refresh / logout:

POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/refresh

POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/logout

Do not call (v1)

No Middleware Backend auth routes. Until Middleware adds /api/v1/bookdirect/auth/*, Core Backend is the winner.