Auth

Auth endpoints are served under /auth.

Public endpoints:

• POST /auth/check — check email availability.
• POST /auth/register — register and return access/refresh token pair.
• POST /auth/login — login and return access/refresh token pair.
• POST /auth/refresh — rotate refresh token.
• POST /auth/verify — verify email with a 6-digit code.
• POST /auth/resend-code — resend verification code.
• POST /auth/forgot-password — start reset flow (202).
• POST /auth/reset-password — reset with one-time token.

Google OAuth:

• GET /auth/google — redirect to Google (optional redirect_uri query: must match an allowlisted frontend origin + path, e.g. https://app.example.com/auth/google/callback).
• GET /auth/google/callback — handle callback and redirect to frontend.
• POST /auth/google/exchange — exchange one-time code for token pair.

Authenticated endpoints:

• POST /auth/change-password
• POST /auth/logout
• POST /auth/logout-all

Notes

• Token shapes are returned by AccessTokenResponse (see kagu-api auth.responses).
• Throttling is enabled per endpoint; handle 429s with backoff/retry where appropriate.