Authentication Endpoints: Login, Register, and Tokens

The Scrubbe authentication API lives under /api/v1/auth and covers the full identity lifecycle: registering a new account, verifying an email address, logging in to receive tokens, refreshing those tokens, and managing your profile. Public endpoints require no credentials; protected endpoints require a valid Bearer token in the Authorization header.

Public endpoints

These endpoints do not require authentication.

Authenticate with email and password. Returns a short-lived access token and a long-lived refresh token.

string

required

The registered email address.

string

required

The account password.

curl --request POST \
  --url "https://your-api-domain.com/api/v1/auth/login" \
  --header "Content-Type: application/json" \
  --data '{
    "email": "user@example.com",
    "password": "s3cur3P@ssword"
  }'

const response = await fetch('https://your-api-domain.com/api/v1/auth/login', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    email: 'user@example.com',
    password: 's3cur3P@ssword'
  })
});
const { data } = await response.json();
// data.accessToken, data.refreshToken

import requests

resp = requests.post(
    "https://your-api-domain.com/api/v1/auth/login",
    json={"email": "user@example.com", "password": "s3cur3P@ssword"}
)
data = resp.json()["data"]
access_token = data["accessToken"]

200 response

{
  "success": true,
  "message": "Login successful.",
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "refreshToken": "dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4...",
    "user": {
      "id": "usr_01HX...",
      "email": "user@example.com",
      "firstName": "Ada",
      "lastName": "Lovelace",
      "role": "ENGINEER"
    }
  }
}

string

JWT to include in the Authorization: Bearer header for protected requests. Short-lived.

string

Long-lived token used to obtain a new access token via POST /auth/refresh-token.

object

Basic profile information for the authenticated user.

POST /auth/business/register

string

required

Name of the organization.

string

required

Owner’s email address.

string

required

Account password (minimum 8 characters).

POST /auth/dev/register

string

required

Developer email address.

string

required

Account password.

Authenticate or register via an OAuth provider (e.g., Google). Redirects to the provider’s consent screen.

string

required

OAuth provider name. Example: "google".

POST /auth/verify_email

Verify an email address using the OTP sent after registration.

string

required

The email address to verify.

string

required

The one-time passcode delivered to the email address.

POST /auth/resend_otp

Resend the email verification OTP. Subject to the email rate limit (3 requests per minute).

string

required

The email address to resend the OTP to.

This endpoint is rate-limited to 3 requests per minute per email address. Repeated calls within the window return 429 Too Many Requests.

POST /auth/forgot-password

Initiate the password reset flow. Sends a reset link or token to the specified email.

string

required

The email address associated with the account.

POST /auth/validate-reset-token

Validate that a password reset token is still active before presenting the reset form.

string

required

The reset token received via email.

POST /auth/reset-password

Set a new password using a valid reset token.

string

required

The reset token from the email.

string

required

The new password (minimum 8 characters).

POST /auth/refresh-token

Exchange a refresh token for a new access token. Does not require the Authorization header.

string

required

A valid, unexpired refresh token.

{
  "success": true,
  "message": "Token refreshed.",
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
  }
}

Protected endpoints

These endpoints require Authorization: Bearer <accessToken>.

POST /auth/logout

Invalidate the current session. The access token is revoked server-side. No request body required.

{
  "success": true,
  "message": "Logged out successfully.",
  "data": {}
}

POST /auth/change-password

Change the authenticated user’s password.

string

required

The user’s current password.

string

required

The new password (minimum 8 characters, must differ from the current password).

GET /auth/me

Retrieve the profile of the currently authenticated user.

{
  "success": true,
  "message": "Profile retrieved.",
  "data": {
    "id": "usr_01HX...",
    "email": "user@example.com",
    "firstName": "Ada",
    "lastName": "Lovelace",
    "role": "ENGINEER",
    "businessId": "biz_01HX...",
    "createdAt": "2025-01-15T10:30:00Z"
  }
}

PUT /auth/profile

Update the authenticated user’s profile information.

string

Updated first name.

string

Updated last name.

string

Contact phone number.

Email address cannot be changed through this endpoint. Contact support to update your login email.

Overview

Incidents & Tickets

Intelligence

Operations

Platform

Authentication Endpoints: Login, Register, and Tokens

Public endpoints

POST /auth/business/register

POST /auth/dev/register

POST /auth/verify_email

POST /auth/resend_otp

POST /auth/forgot-password

POST /auth/validate-reset-token

POST /auth/reset-password

POST /auth/refresh-token

Protected endpoints

POST /auth/logout

POST /auth/change-password

GET /auth/me

PUT /auth/profile

​Public endpoints

​POST /auth/login

​POST /auth/business/register

​POST /auth/dev/register

​POST /auth/oauth/login

​POST /auth/verify_email

​POST /auth/resend_otp

​POST /auth/forgot-password

​POST /auth/validate-reset-token

​POST /auth/reset-password

​POST /auth/refresh-token

​Protected endpoints

​POST /auth/logout

​POST /auth/change-password

​GET /auth/me

​PUT /auth/profile

Public endpoints

POST /auth/login

POST /auth/business/register

POST /auth/dev/register

POST /auth/oauth/login

POST /auth/verify_email

POST /auth/resend_otp

POST /auth/forgot-password

POST /auth/validate-reset-token

POST /auth/reset-password

POST /auth/refresh-token

Protected endpoints

POST /auth/logout

POST /auth/change-password

GET /auth/me

PUT /auth/profile