How to build: authentication

implemented User App /signup, /login, /profile.

Layer winners: Core Backend for register, login, password reset, change password, verify email.

Sign up → Login → store access_token + uuid → Dashboard
Forgot password → email token → validate → login
Profile → change password / verify email

Project Management: activation. ENV / Metadata Catalog. Explorer: Core Backend.

---

1. Register

Core Backend · winnerimplemented

Call this API

POST https://backend-test.nellalink.com/public/api/v1/nellalink/user/register

Headers

x-api-key: {API_KEY}
Content-Type: application/json

Request

{
  "email": "owner@example.com",
  "password": "choose-a-strong-password",
  "password_confirmation": "choose-a-strong-password",
  "name": "Ada Owner",
  "username": "ada_owner"
}

password is min:4 and must be confirmed. Register does not return a JWT. Next: login.

---

2. Login

Core Backend · winnerimplemented

Call this API

POST https://backend-test.nellalink.com/public/api/v1/nellalink/user/login

Request

{
  "email": "owner@example.com",
  "password": "choose-a-strong-password"
}

Store data.access_token and data.uuid. User App writes these to localStorage.

---

3. Forgot password

Core Backend · winnerimplemented

Call this API

POST https://backend-test.nellalink.com/public/api/v1/nellalink/user/reset-password

User App sends { "email_address": "owner@example.com" }. Then validate:

POST https://backend-test.nellalink.com/public/api/v1/nellalink/user/reset-password/validate

---

4. Change password (logged in)

Core Backend · winnerimplemented

Call this API

POST https://backend-test.nellalink.com/public/api/v1/nellalink/user/change-password

Then .../user/change-password/validate. Profile query ?q=change_password.

---

5. Verify email

Core Backend · winnerimplemented

Call this API

POST https://backend-test.nellalink.com/public/api/v1/nellalink/user/verify-email-address

Then .../user/verify-email-address/validate. Profile query ?q=verify.

---

6. Profile

User App /profile. Loads the session user from storage; updates use the same Core user routes. Google / Twitter buttons on login are not wired (to implement for OAuth UI). Core has POST .../user/oauth/google/callback if you add it later.

Metadata: none on Smart Meta. User row + optional meta_data on register.

IDOR: public key may allow register/login. Write-your-own-user paths must require JWT; Core must not treat a body uuid as the logged-in user. Security.