Authentication API /api/auth
Console account authentication. All endpoints except registration and login require a session token:
text
Authorization: Bearer <token returned by login>POST /api/auth/register
| Parameter | Type | Required | Description |
|---|---|---|---|
email | string | Yes | Email address; converted to lowercase before storage |
password | string | Yes | 8–72 characters, including both letters and digits |
displayName | string | No | Display name, up to 60 characters |
bash
curl -X POST "https://modelfold.ai/api/auth/register" \
-H "Content-Type: application/json" \
-d '{"email":"you@example.com","password":"Abcd1234","displayName":"You"}'json
{
"ok": true,
"token": "eyJhbGciOi...",
"user": {
"id": "1",
"email": "you@example.com",
"displayName": "You",
"avatarUrl": "",
"credits": 1000,
"emailVerified": false,
"createdAt": "2026-10-16T12:00:00.000Z"
}
}Successful registration returns a session token valid for seven days and automatically sends a verification email.
| HTTP | error | Cause |
|---|---|---|
400 | invalid_email | Invalid email format |
400 | password_too_short / password_needs_letter_and_digit | Password does not meet the requirements |
409 | email_taken | Email address is already registered |
POST /api/auth/login
| Parameter | Type | Required |
|---|---|---|
email | string | Yes |
password | string | Yes |
bash
curl -X POST "https://modelfold.ai/api/auth/login" \
-H "Content-Type: application/json" \
-d '{"email":"you@example.com","password":"Abcd1234"}'Returns the same response structure as registration.
Failed login attempts always return the same 401 invalid_credentials response, whether the email is unknown or the password is incorrect. A password hash is computed even for unknown accounts to reduce timing differences. This prevents callers from using the endpoint to identify registered addresses.
| HTTP | error | Cause |
|---|---|---|
401 | invalid_credentials | Incorrect email or password |
403 | account_suspended | Account has been suspended |
429 | — | More than 30 requests per IP in ten minutes |
GET /api/auth/me
Returns the signed-in user. The console uses this endpoint to validate the session at startup.
bash
curl "https://modelfold.ai/api/auth/me" -H "Authorization: Bearer $TOKEN"POST /api/auth/logout
Revokes the current session. Other devices remain signed in.
json
{ "ok": true }