Setting authRoutes to true adds a complete email and password account system to your API — registration, login, token refresh, email verification and password reset — without you writing a handler.
apiker.init({
routes,
exports,
authRoutes: true,
objects: ["Common", "Users", "RateLimit"]
});Endpoints
- POST /auth/register — create an account from { email, password }. Limited to 3 per hour.
- POST /auth/login — exchange { email, password } for tokens.
- POST /auth/refresh — swap a refresh token for a new pair.
- DELETE /auth/delete — remove the signed-in account.
- POST /auth/forgot — email a password reset link.
- POST /auth/forgot/reset — complete the reset and email the new password.
- POST /auth/verify — email a verification link.
- POST /auth/verify/action — mark the account verified.
- GET /auth/github/authorize and /auth/github/callback — GitHub OAuth, when GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET are set.
Every auth endpoint is rate limited to 50 requests an hour per caller, apart from registration.
Registering and signing in
curl -X POST https://api.example.com/auth/register \
-H "Content-Type: application/json" \
-d '{ "email": "[email protected]", "password": "correct horse" }'
{
"email": "[email protected]",
"userId": "…",
"token": "eyJ…",
"refreshToken": "eyJ…"
}Tokens
Login returns two JWTs, both signed with HS256 using APIKER_SECRET_KEY. The access token expires after 30 minutes by default; the refresh token does not expire and is exchanged at /auth/refresh.
Send the access token in any of three ways — whichever suits the client:
Authorization: Bearer eyJ…
Cookie: apikerToken=eyJ…
GET /some/route?t=eyJ…Reading the current user
1import { getCurrentUser, getCurrentUserId, isCurrentUserAdmin, res_401 } from "apiker";2 3const profile = async () => {4 const user = await getCurrentUser();5 if (!user) return res_401();6 7 return res({ email: user.email, verified: user.verified });8};getCurrentUserId only reads the token, so prefer it when you just need an id. getCurrentUser also loads the stored record:
{
id: "…",
email: "[email protected]",
role: "admin", // only on admins
password: "…", // bcrypt hash
verified: true,
createdAt: 1710000000000,
updatedAt: 1710000000000
}Verification and reset
Both flows work the same way: the endpoint emails a link containing a token that is valid for five minutes, and the linked endpoint completes the action. A password reset generates a new random password and emails it. Both need email configured.
Admins
import { isUserAdmin, isCurrentUserAdmin, addAdminId } from "apiker";
await isCurrentUserAdmin(); // is the caller an admin?
await isUserAdmin(userId); // is this user an admin?
await addAdminId(userId); // grant admin