> ## Documentation Index
> Fetch the complete documentation index at: https://bobprince-78964c2b.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate with the Hookdrop API using JWT bearer tokens

Every request to the Hookdrop API must include a valid access token in the `Authorization` header:

```bash theme={null}
Authorization: Bearer YOUR_ACCESS_TOKEN
```

<Note>
  Keep your tokens secure. Never expose them in client-side code, public repositories, or anywhere they can be read by untrusted parties.
</Note>

## Register a new account

If you don't have an account yet, create one with `POST /api/auth/register`.

<ParamField body="email" type="string" required>
  Your email address.
</ParamField>

<ParamField body="password" type="string" required>
  Your account password.
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST https://hookdrop.dev/api/auth/register \
    -H "Content-Type: application/json" \
    -d '{
      "email": "you@example.com",
      "password": "your-password"
    }'
  ```
</CodeGroup>

**Response**

<ResponseField name="user" type="object">
  <Expandable title="properties">
    <ResponseField name="id" type="string">
      Unique identifier for your account.
    </ResponseField>

    <ResponseField name="email" type="string">
      The email address associated with your account.
    </ResponseField>

    <ResponseField name="plan" type="string">
      Your current plan: `free`, `starter`, or `pro`.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="accessToken" type="string">
  Short-lived JWT you send with every API request. Expires after 15 minutes.
</ResponseField>

<ResponseField name="refreshToken" type="string">
  Long-lived token used to obtain a new access token when the current one expires.
</ResponseField>

```json theme={null}
{
  "user": {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "email": "you@example.com",
    "plan": "free"
  },
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}
```

***

## Log in to an existing account

Exchange your credentials for tokens using `POST /api/auth/login`.

<ParamField body="email" type="string" required>
  Your account email address.
</ParamField>

<ParamField body="password" type="string" required>
  Your account password.
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST https://hookdrop.dev/api/auth/login \
    -H "Content-Type: application/json" \
    -d '{
      "email": "you@example.com",
      "password": "your-password"
    }'
  ```
</CodeGroup>

**Response**

```json theme={null}
{
  "user": {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "email": "you@example.com",
    "plan": "free"
  },
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}
```

***

## Refresh an access token

Access tokens expire after **15 minutes**. When yours expires, call `POST /api/auth/refresh` with your refresh token to get a new one without logging in again.

<ParamField body="refreshToken" type="string" required>
  The refresh token returned from `/auth/login` or `/auth/register`.
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST https://hookdrop.dev/api/auth/refresh \
    -H "Content-Type: application/json" \
    -d '{
      "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
    }'
  ```
</CodeGroup>

**Response**

```json theme={null}
{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}
```

***

## Using your token

Include the access token in the `Authorization` header of every API request:

```bash theme={null}
Authorization: Bearer YOUR_ACCESS_TOKEN
```

For example, to list your endpoints:

<CodeGroup>
  ```bash cURL theme={null}
  curl https://hookdrop.dev/api/endpoints \
    -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
  ```
</CodeGroup>