Authentication

Every request must include Authorization: Bearer <token>.

POST /api/v1/auth/login

{"email":"user@example.com","password":"yourpassword"}

Response:

{"data":{"accessToken":"eyJ...","refreshToken":"eyJ...","expiresIn":3600}}

Refresh a token

POST /api/v1/auth/refresh

{"refreshToken":"eyJ..."}

Header	Required	Description
`Authorization`	Always	`Bearer <token>`
`X-Organization-ID`	Most endpoints	UUID of your organization

Store access tokens in memory, not localStorage

Store refresh tokens in httpOnly secure cookies

Use HTTPS everywhere

Revoke tokens on logout