Signing in

Password sign-in with email or username, plus session refresh tokens.

POST BASE/v1/api/auth/sign/in/email
Content-Type: application/json

{
  "email": "greatness@daaymail.com",
  "password": "CorrectHorseBattery1!"
}

Or with your username:

POST BASE/v1/api/auth/sign/in/username
Content-Type: application/json

{
  "username": "great",
  "password": "CorrectHorseBattery1!"
}

Successful data includes:

Field	Role
`token`	Access session token — send as `Authorization: Bearer <token>` (or use session cookie)
`refreshToken`	Long-lived opaque token (~30 days) used only to obtain a new access token
`refreshTokenExpiresAt`	When the refresh token expires

POST BASE/v1/api/auth/session/refresh
Content-Type: application/json

{
  "refreshToken": "<from sign-in>"
}

Returns a new token and a rotated refreshToken (previous refresh is revoked; previous session is deleted). Store both replacements.

In Swagger / Scalar, open Authorize and paste the Bearer token after sign-in or refresh.

Session list/revoke, two-factor enable/verify, and passkey register live under /v1/api/auth/* and the related user routes — see the API reference.