> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# REST API endpoints for authentication — login and profile

> InfraAudit auth API endpoints: POST /auth/login to get a token, GET /auth/me for the current user profile, and POST /register to create an account.

The auth endpoints handle user login, registration, and retrieving the authenticated user's profile. The `POST /api/login` endpoint is used by the CLI and any application that needs to exchange credentials for a JWT.

Base path: `/api/v1/auth`

## GET /auth/me — get current user

Returns the profile of the authenticated user.

```http theme={null}
GET /api/v1/auth/me
Authorization: Bearer <token>
```

### Response

```json theme={null}
{
  "id": 1,
  "supabase_id": "550e8400-e29b-41d4-a716-446655440000",
  "email": "user@example.com",
  "role": "user",
  "plan": "starter",
  "created_at": "2024-01-15T10:00:00Z"
}
```

<ResponseField name="id" type="integer">
  Internal user ID.
</ResponseField>

<ResponseField name="supabase_id" type="string">
  The user's UUID in Supabase Auth.
</ResponseField>

<ResponseField name="email" type="string">
  The user's email address.
</ResponseField>

<ResponseField name="role" type="string">
  Account role: `user` or `admin`.
</ResponseField>

<ResponseField name="plan" type="string">
  Subscription plan: `community`, `starter`, `professional`, or `enterprise`.
</ResponseField>

***

## POST /login — sign in and get token

Signs in with email and password, and returns a JWT. Used by the CLI's `auth login` command and non-Supabase client integrations.

```http theme={null}
POST /api/login
Content-Type: application/json
```

### Request body

<ParamField body="email" type="string" required>
  The user's email address.
</ParamField>

<ParamField body="password" type="string" required>
  The user's password.
</ParamField>

Example:

```json theme={null}
{
  "email": "user@example.com",
  "password": "your-password"
}
```

### Response

```json theme={null}
{
  "user": {
    "id": 1,
    "email": "user@example.com",
    "role": "user"
  },
  "token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..."
}
```

***

## POST /register — create an account

Creates a new user account and returns the same response as login.

```http theme={null}
POST /api/register
Content-Type: application/json
```

### Request body

<ParamField body="email" type="string" required>
  Email address for the new account.
</ParamField>

<ParamField body="password" type="string" required>
  Password for the new account.
</ParamField>

Example:

```json theme={null}
{
  "email": "newuser@example.com",
  "password": "your-password"
}
```

### Response

Same structure as [POST /login](#post-login-sign-in-and-get-token).

<Note>
  For refreshing an expired session token, use the Supabase client's `refreshSession()` method. The InfraAudit API does not expose a dedicated refresh endpoint.
</Note>