Authentication

The API uses session-based authentication via Better Auth.

Login

POST /api/auth/login
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "your-password"
}

Response

{
  "user": {
    "id": "user_abc123",
    "email": "user@example.com",
    "name": "Your Name"
  },
  "session": {
    "id": "session_xyz789",
    "expiresAt": "2026-03-01T00:00:00Z"
  }
}

Session Cookies

The response includes Set-Cookie headers. Store and send these with subsequent requests.

Logout

POST /api/auth/logout

Invalidates the current session.

Check Session

GET /api/auth/session

Returns current user if authenticated.

Using Sessions

Include cookies in requests:

// JavaScript fetch
const response = await fetch('/api/admin/products', {
  credentials: 'include'  // Include cookies
});

# cURL with cookies
curl -b cookies.txt https://pintas.turbospark.my/api/admin/products

Rate Limiting

Auth endpoints are rate limited:

Endpoint	Limit
/api/auth/login	5 attempts per 15 min
/api/auth/signup	3 attempts per hour
/api/auth/forgot-password	3 per hour

After limit exceeded:

{
  "error": "Too many requests. Please try again later."
}

Security Best Practices

1. Use HTTPS - Always
2. Don’t share tokens - Keep credentials secure
3. Logout when done - Invalidate sessions
4. Monitor for breaches - Check for unauthorized access