Trace uses JWT Bearer tokens. Access tokens expire after 1 hour. Use the refresh token to get new access tokens without re-authenticating.
Login
POST /auth/login
curl -X POST "https://api.buildwithtrace.com/api/v2/auth/login" \
-H "Content-Type: application/json" \
-d '{
"email": "user@example.com",
"password": "your_password"
}'
{
"access_token": "eyJhbGci...",
"refresh_token": "eyJhbGci...",
"token_type": "bearer",
"user": {
"id": "uuid",
"email": "user@example.com",
"full_name": "John Doe",
"plan": "pro"
}
}
Sign Up
POST /auth/signup
curl -X POST "https://api.buildwithtrace.com/api/v2/auth/signup" \
-H "Content-Type: application/json" \
-d '{
"email": "user@example.com",
"password": "your_password",
"full_name": "John Doe"
}'
Verify Token
GET /auth/verify
curl -X GET "https://api.buildwithtrace.com/api/v2/auth/verify" \
-H "Authorization: Bearer YOUR_TOKEN"
Refresh Token
POST /auth/refresh
curl -X POST "https://api.buildwithtrace.com/api/v2/auth/refresh" \
-H "Content-Type: application/json" \
-d '{
"refresh_token": "your_refresh_token"
}'
Logout
POST /auth/logout
curl -X POST "https://api.buildwithtrace.com/api/v2/auth/logout" \
-H "Authorization: Bearer YOUR_TOKEN"
OAuth Authentication
Google
Redirect users to initiate Google OAuth:
GET https://api.buildwithtrace.com/api/v2/auth/google?redirect_uri=YOUR_CALLBACK
GitHub
Redirect users to initiate GitHub OAuth:
GET https://api.buildwithtrace.com/api/v2/auth/github?redirect_uri=YOUR_CALLBACK
Exchange Code
After OAuth callback, exchange the authorization code for tokens:
curl -X POST "https://api.buildwithtrace.com/api/v2/auth/exchange-code" \
-H "Content-Type: application/json" \
-d '{
"code": "oauth_authorization_code",
"provider": "google"
}'
Password Management
Forgot Password
POST /auth/forgot-password
curl -X POST "https://api.buildwithtrace.com/api/v2/auth/forgot-password" \
-H "Content-Type: application/json" \
-d '{"email": "user@example.com"}'
Reset Password
POST /auth/reset-password
curl -X POST "https://api.buildwithtrace.com/api/v2/auth/reset-password" \
-H "Content-Type: application/json" \
-d '{
"token": "reset_token_from_email",
"new_password": "new_secure_password"
}'
Error Responses
| Status | Description |
|---|
| 401 | Invalid credentials or expired token |
| 409 | Email already registered (signup) |
| 422 | Invalid request body |
| 429 | Too many attempts |
