Auth Service API Documentation

This document describes the authentication endpoints for the Auth Service. All endpoints are versioned under /api/v2/auth.

Overview

The Auth Service implements a stateless JWT-based authentication system with refresh token rotation. Tokens are signed using RS256 and validated at the API gateway layer without requiring a database lookup.

Endpoints

POST /auth/login

Authenticates a user and returns a JWT access token and refresh token.

POST /api/v2/auth/login
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "••••••••"
}

Response

{
  "accessToken": "eyJhbG...",
  "refreshToken": "dGhpcy...",
  "expiresIn": 900
}

Note: Access tokens expire in 15 minutes. Refresh tokens are valid for 7 days and are rotated on every use.