API Authentication

The LearnHouse API supports JWT cookies for browser sessions and API tokens for programmatic access.

JWT Authentication

Login to receive a JWT access token (HS256, expires in 8 hours):

curl -X POST http://localhost:1338/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "your-password"}'

Then authenticate requests via the Authorization header:

curl http://localhost:1338/api/v1/users/me \
  -H "Authorization: Bearer <access_token>"

The token is also set as an access_token_cookie for browser-based sessions. Use /api/v1/auth/refresh to renew expired tokens within the 30-day refresh window.

API Tokens

For programmatic access, use API tokens (prefixed with lh_):

curl http://localhost:1338/api/v1/users/me \
  -H "Authorization: Bearer lh_your_api_token_here"

Auth Endpoints