# Authentication Endpoints

This document covers the public and authenticated auth endpoints.

## Public endpoints

### Login

```http
POST /api/v1/login
```

Request:

```json
{
  "email": "user@example.com",
  "password": "secret"
}
```

Response includes a Sanctum token:

```json
{
  "data": {
    "user": {...},
    "token": "{sanctum_token}"
  }
}
```

Unverified accounts receive a `403` response.

### Register owner

```http
POST /api/v1/register/owner
```

Creates a `User` and an `Owner` profile. Sends an OTP.

### Register customer

```http
POST /api/v1/register/customer
```

Creates a `User` and a `Customer` profile. Links any prior `PendingCustomer` reservations.

### Verify OTP

```http
POST /api/v1/verify-otp
```

Validates the OTP and marks the user as verified.

### Verify account

```http
POST /api/v1/verify-account
```

Alternative verification endpoint.

### Resend OTP

```http
POST /api/v1/resend-otp
```

Resends the OTP if the user exists and is unverified.

### Forgot password

```http
POST /api/v1/forgot-password
```

Creates a password-reset token and sends a reset email.

### Reset password

```http
POST /api/v1/reset-password
```

Validates the reset token and updates the password.

## Authenticated endpoints

These require a valid bearer token.

### Logout

```http
POST /api/v1/logout
```

Deletes the current access token.

### Update password

```http
PUT /api/v1/update-password
```

Changes the authenticated user's password after verifying the current password.

## Environment note on OTPs

OTP codes are exposed in API responses only in `local` and `testing` environments for development convenience. In production, OTPs are sent through the configured channel only.

## Token usage

After login, include the token in all subsequent requests:

```http
Authorization: Bearer {sanctum_token}
```

Tokens expire after one week by default.