Overview

How project authorization works

A project can expose its own authorization endpoints so your frontend can exercise a real login flow: registration, sign-in, token refresh and resources that answer 401 without a token.

Turn it on from the project page: open Settings, enable Authorization, pick a users collection and save. Registration inserts a record into that collection — email and password plus whatever else you send — so seeded users work for login too, and everything is visible in the dashboard.

Endpoints

Register, login, refresh

methodpathwhat it does
POST/registerCreate a user, returns tokens and the record
POST/authSign in with email and password
POST/auth/refreshExchange a refresh token for a new pair

The /register body is a JSON object. Two fields are required, everything else is up to you:

fieldtypemeaning
emailstringRequired. Must be a valid email, unique within the users collection.
passwordstringRequired. At least 6 characters, compared as-is on login.
…anyAny other fields (name, role, avatar, …) are stored on the user record unchanged and come back in data.
example
POST /m/acme/register
{ "email": "ann@team.dev", "password": "secret1", "name": "Ann" }
response
201
{
  "token": "eyJhbGciOi…",
  "refresh_token": "eyJhbGciOi…",
  "data": { "id": 1, "email": "ann@team.dev", "name": "Ann" }
}

The /auth body is exactly email and password — they are checked against the fields of a record in the users collection:

example
POST /m/acme/auth
{ "email": "ann@team.dev", "password": "secret1" }

Login and refresh answer with the same shape as registration: token, refresh_token and the user record under data, password stripped.

Error responses of the auth endpoints:

codewhen
400Body failed validation: missing email or password, invalid email, password shorter than 6 characters
401Wrong email or password · invalid, expired or foreign refresh token
409Email is already registered in the users collection
Tokens

Access and refresh tokens

Both endpoints answer with an access token, a refresh token and the user record under data (password stripped). The access token lives 1 hour by default — configurable in the project settings from 1 minute to 30 days; the refresh token always lives 30 days. POST the refresh token to /auth/refresh as { "refresh_token": "…" } to get a fresh pair.

example
POST /m/acme/auth/refresh
{ "refresh_token": "eyJhbGciOi…" }
Private resources

Protecting resources with a token

Once authorization is enabled on the project, any resource can be marked private — via the lock icon in the resource list or in the resource settings. Requests to a private resource must carry the access token in the Authorization header, otherwise they answer 401.

example
GET /m/acme/orders
Authorization: Bearer eyJhbGciOi…
Notes

Rules and limitations

Registration requires an email and a password of at least 6 characters; extra fields are stored on the user record as-is. Passwords are kept in the collection as plain mock data — do not reuse real ones. The names auth and register are reserved and cannot be used as collection names.

mockly