Auth
Authentication APIs provides the ability to authenticate a user and get a JWT token, refresh the JWT token, request a password reset, reset the password, signup a new user, confirm a family or admin user, and signout. The JWT token is used to authenticate the user in the other APIs and has exiration time of 10 min. In order to get a new JWT token after it has expired, the user can use the refresh-token endpoint. The refresh token is stored in an HttpOnly cookie that Javascript can never read and that's limited by path. The refresh token is used to renew the JWT token without the need to re-enter the credentials. The refresh token has an expiration time of 24 hours. For more details see the documentation of Yii2.
Signin
Signin a user using email and password. Returns a JWT token. The refresh token is set as an HttpOnly cookie (not in the response body) and is used to renew the JWT without re-entering credentials.
Refresh JWT token
Exchanges the refresh token (sent automatically as an HttpOnly cookie) for a new JWT. Issues a new refresh token cookie (rotation). Reuse of a consumed token invalidates the entire session family.
Signout
Revokes all tokens in the session family (read from the HttpOnly cookie) and clears the cookie.
Request password reset
When this API is called, an email containing a link to a frontend page with a token is sent to the email address written in the payload. The page linked will use the reset-password API to change the password of user.
Reset the password
Reset the password
Update the password
Update the password
Accept terms and conditions
Accept terms and conditions
Signup
Signup a new user. Users can be families, teachers or admins and the request payload is different in the three cases.
Get a teacher token
Get a teacher token
Generate a new teacher token
Generate a new teacher token
Delete a teacher token
Delete a teacher token
Confirm a family user
Confirm a family user
Confirm an admin user
Confirm an admin user
Link Google account
Links a Google account to the authenticated user. Requires a valid Google ID Token obtained via Google Sign-In on the frontend. Once linked, the user's `google_email` is stored and used for calendar sharing and Meet link generation. Returns 409 if a Google account is already linked.
Unlink Google account
Removes the Google account linked to the authenticated user. If the teacher had calendar sync enabled, the calendar share is automatically revoked and both `google_calendar_sync_enabled` and `google_meet_link_enabled` are reset to false.
Enable or disable Google Calendar sync
Enables or disables sharing of the teacher's platform calendar with their linked Google account. When enabled, the teacher will see their lessons directly in Google Calendar. Requires: (1) the user to be a teacher, (2) a Google account already linked via `POST /api/auth/google/link`, (3) the teacher's `google_calendar_id` to be already provisioned (created automatically in background at teacher registration).
Enable or disable automatic Meet link generation
Enables or disables automatic Google Meet link generation for online lessons. When enabled, every online lesson event created on the teacher's calendar will include a Meet conference link. Requires: (1) the user to be a teacher, (2) a Google account already linked via `POST /api/auth/google/link`. Can be toggled independently of calendar sync.