All routes are versioned under /api/v1. Requests and responses are JSON. Authenticated routes take an Authorization: Bearer <token> header.
Responses use { "ok": true, ... } for success and a non-2xx status with { "ok": false, "error": "..." } for failure. CORS allows the configured origin with the content-type and authorization headers.
Public. Returns captchaProvider, captchaSiteKey, and allowRegistration. Use it to render the captcha widget.
Create an account. Body: { username, password, email?, captcha? }. Returns 201 on success.
Body: { username, password, captcha? }. Returns { token, refreshToken, user }.
Revokes the current session. Authenticated.
Returns the current user. Authenticated. A 401 triggers a client refresh.
Body: { refreshToken }. Returns a new { token, refreshToken } pair.
Body: { username, captcha? }. Issues a reset token and emails a link. Always returns success so the endpoint cannot enumerate accounts.
Body: { token, password }. Sets the new password and marks the token used.
| Status | Meaning |
|---|---|
| 400 | Malformed request or invalid input |
| 401 | Missing or invalid credentials or token |
| 403 | Insufficient permission |
| 409 | Conflicting state, such as an existing username |
| 429 | Rate limit exceeded |
| 500 | Server error |
Error strings are stable and safe to display. Never log tokens or passwords.