## Authentication and anathomy of the API requests


### General API requests

Each of the regular requests sent to the API must contain the following headers:

- Accept: application/json (mandatory)
- Lang-Code: en/pt (optional) - see [localization.md](localization.md) 


### User registration

The API user registration is done using the POST endpoint /api/register and the following fields must be provided:

- name
- email
- password
- password_confirmation
- language_id (optional, if not provided 'pt' will be assumed)
- device_id  The unique device identifier
- fcm_token (optional for receiving push notifications)


### Secured API requests

In the API there are some routes that can only be acessible using a JWT token.

These endpoints are:
* POST - /api/refresh
* POST - /api/logout
* POST - /api/profile

This token is generated using the /api/login (POST) route by providing the user's email and password.
The login return, if successful is as the following example:

```json
{
    "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.              eyJpc3MiOiJodHRwOlwvXC9jb250ZW1wb3JhbmVhLmxuZG8uc2l0ZVwvYXBpXC92MVwvbG9naW4iLCJpYXQiOjE2NTIzNjMwNzYsImV4cCI6MTY1MjM2NjY3NiwibmJmIjoxNjUyMzYzMDc2LCJqdGkiOiI0QkJIUGlTZTFMV01sZFhHIiwic3ViIjoyLCJwcnYiOiIyM2JkNWM4OTQ5ZjYwMGFkYjM5ZTcwMWM0MDA4NzJkYjdhNTk3NmY3In0.abeQu5rRaPRpR9rHj9e1wk5r_d0X8wJcFpqHHN-i0d4",
    "token_type": "bearer",
    "expires_in": 3600
}
```

The provided access token is valid for an hour and must be used in each subsequent protected request.
The token must be added to the requests using the header "Authorization" and should be in the following format:

```diff
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.              eyJpc3MiOiJodHRwOlwvXC9jb250ZW1wb3JhbmVhLmxuZG8uc2l0ZVwvYXBpXC92MVwvbG9naW4iLCJpYXQiOjE2NTIzNjMwNzYsImV4cCI6MTY1MjM2NjY3NiwibmJmIjoxNjUyMzYzMDc2LCJqdGkiOiI0QkJIUGlTZTFMV01sZFhHIiwic3ViIjoyLCJwcnYiOiIyM2JkNWM4OTQ5ZjYwMGFkYjM5ZTcwMWM0MDA4NzJkYjdhNTk3NmY3In0.abeQu5rRaPRpR9rHj9e1wk5r_d0X8wJcFpqHHN-i0d4
```


In an authenticated request the response will contain the header "Authorization" either with the token in use or with a renewed token if the previous one is about to expire:

```diff
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwOlwvXC9jb250ZW1wb3JhbmVhLmxuZG8uc2l0ZVwvYXBpXC92MVwvbG9naW4iLCJpYXQiOjE2NTIzNjMwNzYsImV4cCI6MTY1MjM2NjY3NiwibmJmIjoxNjUyMzYzMDc2LCJqdGkiOiI0QkJIUGlTZTFMV01sZFhHIiwic3ViIjoyLCJwcnYiOiIyM2JkNWM4OTQ5ZjYwMGFkYjM5ZTcwMWM0MDA4NzJkYjdhNTk3NmY3In0.abeQu5rRaPRpR9rHj9e1wk5r_d0X8wJcFpqHHN-i0d4
```

if one hour passes with no activity once authenticated, a new token will need to be created using the login endpoint.