oCoreoCore Docs
API Reference

Auth

Request a password reset email

Sends a password reset link to the specified email. Always returns 200 to avoid leaking account existence.

POST
/auth/forgot-password

Request Body

application/jsonRequired

Email address

emailstring
curl -X POST "//api.ocore.dev/api/auth/forgot-password" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "string"
  }'

OK

{
  "message": "string"
}

Authenticate with email and password

Validates credentials and returns user data with auth cookies. If TOTP is enabled, returns a partial token requiring 2FA verification.

POST
/auth/login

Request Body

application/jsonRequired

Login credentials

emailstring
passwordstring
curl -X POST "//api.ocore.dev/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "string",
    "password": "string"
  }'

OK

{
  "partialToken": "string",
  "requiresTOTP": true,
  "user": {}
}

Complete two-factor authentication login

Validates a TOTP code against a partial token to complete 2FA login. Sets auth cookies on success.

POST
/auth/login/2fa

Request Body

application/jsonRequired

2FA verification

codestring
partialTokenstring
curl -X POST "//api.ocore.dev/api/auth/login/2fa" \
  -H "Content-Type: application/json" \
  -d '{
    "code": "string",
    "partialToken": "string"
  }'

OK

{
  "user": {}
}

Log out and invalidate session

Revokes the refresh token and clears auth cookies.

POST
/auth/logout
curl -X POST "//api.ocore.dev/api/auth/logout"

OK

{
  "message": "string"
}

Begin OAuth authentication flow

Redirects to the OAuth provider's authorization page. Supports login and account-linking flows.

GET
/auth/oauth/{provider}

Path Parameters

providerRequiredstring

OAuth provider (github, google)

Query Parameters

flowstring

Flow type: login or link

Default: "login"
curl -X GET "//api.ocore.dev/api/auth/oauth/<string>?flow=login"

Redirect to OAuth provider

Handle OAuth provider callback

Processes the OAuth provider's redirect with authorization code. Completes login or account linking. Redirects to frontend.

GET
/auth/oauth/{provider}/callback

Path Parameters

providerRequiredstring

OAuth provider (github, google)

Query Parameters

codeRequiredstring

Authorization code from provider

stateRequiredstring

CSRF state parameter

curl -X GET "//api.ocore.dev/api/auth/oauth/<string>/callback?code=%3Cstring%3E&state=%3Cstring%3E"

Redirect to frontend

Refresh access token

Uses the refresh_token cookie to issue a new access token and refresh token pair.

POST
/auth/refresh
curl -X POST "//api.ocore.dev/api/auth/refresh"

OK

{
  "message": "string"
}

Reset password with token

Resets the user's password using a valid reset token obtained from forgot-password.

POST
/auth/reset-password

Request Body

application/jsonRequired

Reset token and new password

passwordstring
tokenstring
curl -X POST "//api.ocore.dev/api/auth/reset-password" \
  -H "Content-Type: application/json" \
  -d '{
    "password": "string",
    "token": "string"
  }'

OK

{
  "message": "string"
}

Register a new user account

Creates a new user account with name, email, and password. Sends a verification email if mail service is configured; otherwise auto-verifies.

POST
/auth/signup

Request Body

application/jsonRequired

Signup request

emailstring
namestring
passwordstring
curl -X POST "//api.ocore.dev/api/auth/signup" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "string",
    "name": "string",
    "password": "string"
  }'

Created

{
  "message": "string"
}

Verify email address

Validates the email verification token and redirects to the login page with a verified flag.

GET
/auth/verify-email

Query Parameters

tokenRequiredstring

Email verification token

curl -X GET "//api.ocore.dev/api/auth/verify-email?token=%3Cstring%3E"

Redirect to login page

Sends a new verification email to the specified address. Always returns 200 to avoid leaking account existence.

POST
/auth/verify-email/resend

Request Body

application/jsonRequired

Email address

emailstring
curl -X POST "//api.ocore.dev/api/auth/verify-email/resend" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "string"
  }'

OK

{
  "message": "string"
}

Was this page helpful?
Edit on GitHub

Health

Previous Page

Account

Next Page