How to build: sign up and login
Layer winners: Core for register, login, refresh, logout, password reset.
Build /auth/sign-up, /auth/sign-in, /auth/forgot-password. Store access_token and user uuid. Then send the guest to search, or the owner to property setup.
Sign up → Login → store token + uuid → next screen
Forgot password → email token → validate → loginExplorer: Core — Auth users
1. Register
Core · winner
Call this API
POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/register
Path: POST /public/api/v1/nellalink/user/register
Headers
x-api-key: {API_KEY}
Content-Type: application/jsonRequest
{
"email": "owner@example.com",
"password": "choose-a-strong-password",
"password_confirmation": "choose-a-strong-password",
"name": "Ada Owner",
"username": "ada_owner"
}password is min:4 and must be confirmed. username is optional (letters, numbers, _, no __). name falls back to the email local-part.
Response (store data.uuid)
{
"status": true,
"status_code": 201,
"message": "User created successfully",
"data": {
"uuid": "550e8400-e29b-41d4-a716-446655440000",
"email": "owner@example.com",
"username": "ada_owner",
"name": "Ada Owner"
}
}Register does not return a JWT. Next step: login.
How to build: after register, call login. Session identity is data.uuid from login only. Core should allow register/login on the public or auth key; it must not treat a body uuid as the logged-in user.
2. Login
Core · winner
Call this API
POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/login
Path: POST /public/api/v1/nellalink/user/login
Headers
x-api-key: {API_KEY}
Content-Type: application/jsonRequest (minimum)
{
"email": "owner@example.com",
"password": "choose-a-strong-password"
}Request (recommended — device + refresh so the 30-minute JWT can rotate)
{
"email": "owner@example.com",
"password": "choose-a-strong-password",
"device": {
"device_id": "d_web_chrome_9f2a",
"platform": "web",
"device_label": "Chrome on MacBook",
"issue_refresh_token": true,
"bind_ip": false
}
}Keep bind_ip false for browsers and phones.
Response (store these)
| Field | Store as |
|---|---|
data.access_token | Authorization: Bearer … on later calls |
data.uuid | session user id — use as owned_by |
data.refresh_token | only if you asked for it — never in a public URL |
{
"status": true,
"status_code": 200,
"message": "Login successful.",
"data": {
"uuid": "550e8400-e29b-41d4-a716-446655440000",
"email": "owner@example.com",
"access_token": "eyJ..."
}
}Next: owner → set up a property. Guest → search and book.
How to build: store data.uuid and send it as owned_by on later creates. Core (JWT + path settings) must reject a body owned_by that is not this user. Not a frontend IDOR task.
3. Refresh access token
Core · winner
Call this API
POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/refresh
{
"refresh_token": "nll_rt_..."
}JWT middleware is skipped on this path. Use it when the access token expires (~30 minutes).
4. Logout
Core · winner
Call this API
POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/logout
POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/logout-all
Send { "refresh_token": "..." }. Then clear local token + uuid.
5. Forgot / reset password
Core · winner
Send token
POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/reset-password
Finish reset
POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/reset-password/validate
Send-token body: { "email": "owner@example.com" }. Validate body: email + token + new password (see Core explorer). Then send the user through Login.
Verify email (optional after register):
POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/verify-email-address
6. Read own profile
Core · winner
Call this API
GET https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/{user_uuid}
{user_uuid} must be the session data.uuid.
x-api-key: {API_KEY}
Authorization: Bearer {access_token}How to build the account screen: GET your own {user_uuid} from login. Core must deny GET /user/{other_uuid} on the public key (path settings / JWT). If that deny is missing, recommend it on Core — do not treat the UI as the control.
Frontend checklist
- [ ] Sign-up form posts register, then login
- [ ] Sign-in form posts login; store token + uuid
- [ ] Silent refresh before JWT expiry
- [ ] Logout clears storage
- [ ] Forgot-password screen uses reset-password pair
- [ ] All later Core/Middleware calls send
x-api-key+ Bearer
Do not call (v1)
No Middleware auth routes. If Middleware later adds /api/v1/bookdirect/auth/*, an iteration must prefer those and demote these Core URLs. Until then, Core is the winner.