Authentication API Guideline

The API uses two authentication layers:

1. Partner authentication identifies the channel partner with a short-lived Partner-Access-Token.
2. User authentication identifies a signed-in customer with a Laravel Sanctum bearer token.

Authentication Flow

Common Headers

All /api/v1/auth/* endpoints require partner authentication.

Header	Value	Required	Description
Partner-Access-Token	Base64 String	Yes	Short-lived AES partner token. See Partner Access Token.
Content-Type	application/json	Yes	Use multipart/form-data for profile image upload.
Accept	application/json	Yes	Ensures validation errors are returned as JSON.
Accept-Language	e.g. en, th, mm, zh-cn	Optional	Response language. Unsupported values fall back to English.
X-Currency	e.g. THB	Optional	Defaults to THB when absent or invalid.

Protected user endpoints additionally require:

Authorization: Bearer <user-sanctum-token>

Token Handling

• A successful login, verified registration, provider login, or password reset returns the user token in data.token and in the Authorization response header.
• Login, provider login, verified registration, and password reset responses also include data.expires_at.
• These user tokens expire 30 days after they are issued. The lifetime is configurable through SANCTUM_USER_TOKEN_EXPIRATION_DAYS.
• Store the token securely and send it as a bearer token on protected user endpoints.
• Logout revokes only the token used for that request.
• A missing or invalid user bearer token normally returns HTTP 401.

Response Convention

Successful responses use result: 1:

{
  "result": 1,
  "message": "success",
  "data": {}
}

Application-level failures commonly use HTTP 200 with result: 0:

{
  "result": 0,
  "message": "Wrong password"
}

Request validation failures use HTTP 422. Partner-token and unauthenticated-user failures use HTTP 401.

Registration Flow

1. Call /api/v1/auth/register with the complete registration payload.
2. Read the six-digit OTP sent to the user's email. It is valid for one hour.
3. Call /api/v1/auth/verify-register with the same payload plus code.
4. Save the returned Sanctum token.

Password Reset Flow

1. Call /api/v1/auth/request-forget-password with the email.
2. Call /api/v1/auth/verify-forget-password to check the emailed OTP.
3. Call /api/v1/auth/reset-password with the email, OTP, and new confirmed password.
4. Save the newly returned Sanctum token.