User/ Auth

Log in with Google or Apple

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"

timezone?string

Client timezone

Default"UTC"

device?string

Client device type/details

Default"ios"

Accept-Language?string

Client language/locale preference

Default"en"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

provider*string

Social login provider

Value in

"google"
"apple"

code*string

Authorization code returned by the provider SDK

email?string

Email supplied by the client (used as a fallback for Apple)

Formatemail

name?string

Display name supplied by the client (used as a fallback for Apple)

pushToken?string

FCM push token for notifications

deviceInfo?

Device metadata

Response Body

`application/json`

curl -X POST "https://example.com/api/user/auth/v1/social_login" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Content-Type: application/json" \  -d '{    "provider": "google",    "code": "string"  }'

{  "code": "string",  "response": {    "accessToken": "string",    "refreshToken": "string",    "sessionId": "string",    "user": {      "_id": "string",      "loginType": "email",      "email": "string",      "profile": {        "name": "string",        "locale": "en",        "timezone": "utc",        "currency": "usd"      },      "twoFactor": {},      "onboardingCompleted": true    }  }}

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"

timezone?string

Client timezone

Default"UTC"

device?string

Client device type/details

Default"ios"

Accept-Language?string

Client language/locale preference

Default"en"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

email*string

Registered email address

Formatemail

password*string

Account password

Length8 <= length <= 128

pushToken?string

FCM push token for notifications

deviceInfo?

Device metadata

Response Body

`application/json`

curl -X POST "https://example.com/api/user/auth/v1/login" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Content-Type: application/json" \  -d '{    "email": "user@example.com",    "password": "stringst"  }'

{  "code": "string",  "response": {    "accessToken": "string",    "refreshToken": "string",    "sessionId": "string",    "user": {      "_id": "string",      "loginType": "email",      "email": "string",      "profile": {        "name": "string",        "locale": "en",        "timezone": "utc",        "currency": "usd"      },      "twoFactor": {},      "onboardingCompleted": true    }  }}

Change the authenticated user password

Authorization

user-access-token

AuthorizationBearer <token>

User access token. In Apidog use token value {{user_access_token}}.

In: header

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"

timezone?string

Client timezone

Default"UTC"

device?string

Client device type/details

Default"ios"

Accept-Language?string

Client language/locale preference

Default"en"

Authorization*string

Requires the user access token generated by the login or refresh endpoint. Apidog value: Bearer {{user_access_token}}.

Default"Bearer {{user_access_token}}"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

currentPassword*string

Current account password

Length8 <= length <= 128

newPassword*string

New account password

Length8 <= length <= 128

confirmPassword*string

New password confirmation; must match newPassword

Length8 <= length <= 128

pushToken?string

FCM push token for the new session

deviceInfo?

Device metadata for the new session

Response Body

`application/json`

curl -X POST "https://example.com/api/user/auth/v1/change_password" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Authorization: Bearer {{user_access_token}}" \  -H "Content-Type: application/json" \  -d '{    "currentPassword": "stringst",    "newPassword": "stringst",    "confirmPassword": "stringst"  }'

{  "code": "string",  "response": {    "accessToken": "string",    "refreshToken": "string",    "sessionId": "string",    "user": {      "_id": "string",      "loginType": "email",      "email": "string",      "profile": {        "name": "string",        "locale": "en",        "timezone": "utc",        "currency": "usd"      },      "twoFactor": {},      "onboardingCompleted": true    }  }}

Register

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"

timezone?string

Client timezone

Default"UTC"

device?string

Client device type/details

Default"ios"

Accept-Language?string

Client language/locale preference

Default"en"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

email*string

Email address for the new account

Formatemail

password*string

Password for the new account

Length8 <= length <= 128

pushToken?string

FCM push token for notifications

deviceInfo?

Device metadata

Response Body

`application/json`

curl -X POST "https://example.com/api/user/auth/v1/register" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Content-Type: application/json" \  -d '{    "email": "user@example.com",    "password": "stringst"  }'

{  "code": "string",  "response": {}}

Start forgot password and send OTP

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"

timezone?string

Client timezone

Default"UTC"

device?string

Client device type/details

Default"ios"

Accept-Language?string

Client language/locale preference

Default"en"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

email*string

Email address for the account that needs a password reset

Formatemail

Response Body

`application/json`

curl -X POST "https://example.com/api/user/auth/v1/forgot_password" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Content-Type: application/json" \  -d '{    "email": "user@example.com"  }'

{  "code": "string",  "response": {}}

Set a new password after OTP verification

Authorization

user-forgot-password-token

AuthorizationBearer <token>

Forgot-password token. In Apidog use token value {{user_forgot_password_token}}.

In: header

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"

timezone?string

Client timezone

Default"UTC"

device?string

Client device type/details

Default"ios"

Accept-Language?string

Client language/locale preference

Default"en"

Authorization*string

Requires the forgot-password token returned by forgot_password before OTP verification or password reset. Apidog value: Bearer {{user_forgot_password_token}}.

Default"Bearer {{user_forgot_password_token}}"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

password*string

New account password

Length8 <= length <= 128

confirmPassword*string

New password confirmation; must match password

Length8 <= length <= 128

pushToken?string

FCM push token for notifications

deviceInfo?

Device metadata

twoFactorCode?string

TOTP or recovery code when the account has MFA enabled.

Match^(?:\d{6}|[A-Za-z0-9-]{8,12})$

Length6 <= length <= 12

twoFactorRecoveryCode?boolean

Set true when twoFactorCode is a one-time recovery code.

Response Body

`application/json`

curl -X POST "https://example.com/api/user/auth/v1/forgot_password/reset" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Authorization: Bearer {{user_forgot_password_token}}" \  -H "Content-Type: application/json" \  -d '{    "password": "stringst",    "confirmPassword": "stringst"  }'

{  "code": "string",  "message": "string"}

Verify registration OTP and create the user session

Authorization

user-register-token

AuthorizationBearer <token>

Registration token. In Apidog use token value {{user_register_token}}.

In: header

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"

timezone?string

Client timezone

Default"UTC"

device?string

Client device type/details

Default"ios"

Accept-Language?string

Client language/locale preference

Default"en"

Authorization*string

Requires the registration token returned by register before email OTP verification. Apidog value: Bearer {{user_register_token}}.

Default"Bearer {{user_register_token}}"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

otp*string

6-digit OTP code; the bearer token identifies whether this is registration or password reset

Length6 <= length <= 6

Response Body

`application/json`

curl -X POST "https://example.com/api/user/auth/v1/register/verify_otp" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Authorization: Bearer {{user_register_token}}" \  -H "Content-Type: application/json" \  -d '{    "otp": "string"  }'

{  "code": "string",  "response": {    "accessToken": "string",    "refreshToken": "string",    "sessionId": "string",    "user": {      "_id": "string",      "loginType": "email",      "email": "string",      "profile": {        "name": "string",        "locale": "en",        "timezone": "utc",        "currency": "usd"      },      "twoFactor": {},      "onboardingCompleted": true    }  }}

Verify forgot-password OTP

Authorization

user-forgot-password-token

AuthorizationBearer <token>

Forgot-password token. In Apidog use token value {{user_forgot_password_token}}.

In: header

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"

timezone?string

Client timezone

Default"UTC"

device?string

Client device type/details

Default"ios"

Accept-Language?string

Client language/locale preference

Default"en"

Authorization*string

Requires the forgot-password token returned by forgot_password before OTP verification or password reset. Apidog value: Bearer {{user_forgot_password_token}}.

Default"Bearer {{user_forgot_password_token}}"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

otp*string

6-digit OTP code; the bearer token identifies whether this is registration or password reset

Length6 <= length <= 6

Response Body

`application/json`

curl -X POST "https://example.com/api/user/auth/v1/forgot_password/verify_otp" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Authorization: Bearer {{user_forgot_password_token}}" \  -H "Content-Type: application/json" \  -d '{    "otp": "string"  }'

{  "code": "string",  "response": {}}

Resend the OTP for the bearer token flow

Authorization

user-register-token

AuthorizationBearer <token>

Registration token. In Apidog use token value {{user_register_token}}.

In: header

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"

timezone?string

Client timezone

Default"UTC"

device?string

Client device type/details

Default"ios"

Accept-Language?string

Client language/locale preference

Default"en"

Authorization*string

Requires the registration token returned by register before email OTP verification. Apidog value: Bearer {{user_register_token}}.

Default"Bearer {{user_register_token}}"

Response Body

`application/json`

curl -X POST "https://example.com/api/user/auth/v1/resend_otp" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Authorization: Bearer {{user_register_token}}"

{  "code": "string",  "response": {}}

Refresh token

Authorization

user-refresh-token

AuthorizationBearer <token>

User refresh token. In Apidog use token value {{user_refresh_token}}.

In: header

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"

timezone?string

Client timezone

Default"UTC"

device?string

Client device type/details

Default"ios"

Accept-Language?string

Client language/locale preference

Default"en"

Authorization*string

Requires the user refresh token generated by the login or refresh endpoint. Apidog value: Bearer {{user_refresh_token}}.

Default"Bearer {{user_refresh_token}}"

Response Body

`application/json`

curl -X POST "https://example.com/api/user/auth/v1/refresh_token" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Authorization: Bearer {{user_refresh_token}}"

{  "code": "string",  "response": {    "accessToken": "string",    "refreshToken": "string",    "sessionId": "string",    "user": {      "_id": "string",      "loginType": "email",      "email": "string",      "profile": {        "name": "string",        "locale": "en",        "timezone": "utc",        "currency": "usd"      },      "twoFactor": {},      "onboardingCompleted": true    }  }}

Logout

Authorization

user-access-token

AuthorizationBearer <token>

User access token. In Apidog use token value {{user_access_token}}.

In: header

Header Parameters

env?string

Environment override (use "test" to bypass payload encryption)

Default"test"

timezone?string

Client timezone

Default"UTC"

device?string

Client device type/details

Default"ios"

Accept-Language?string

Client language/locale preference

Default"en"

Authorization*string

Requires the user access token generated by the login or refresh endpoint. Apidog value: Bearer {{user_access_token}}.

Default"Bearer {{user_access_token}}"

Response Body

`application/json`

curl -X POST "https://example.com/api/user/auth/v1/logout" \  -H "env: test" \  -H "timezone: UTC" \  -H "device: ios" \  -H "Accept-Language: en" \  -H "Authorization: Bearer {{user_access_token}}"

{  "code": "string",  "message": "string"}

201application/json

400

401

201application/json

400

401

201application/json

400

401

201application/json

400

401

201application/json

400

401

200application/json

201application/json

400

401

201application/json

400

401

201application/json

400

401

201application/json

401

200application/json

201application/json

401

200application/json

201application/json

401

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`