docs
authentication
jwt
JWT Tokens
JWT Authentication
Mithril implements JSON Web Token authentication with access and refresh token pairs in internal/auth/.
Endpoints#
| Method | Path | Description |
|---|---|---|
| POST | /auth/login | Email + password → tokens |
| POST | /auth/refresh | Refresh access token |
| POST | /auth/logout | Clear cookies |
| GET | /auth/me | Current user (JWT required) |
| POST | /auth/register | Register (only if ENABLE_REGISTER=true) |
Planned (return 501)
/auth/forgot-password,/auth/reset-password/auth/send-otp,/auth/verify-otp/auth/enable-2fa,/auth/verify-2fa
Login#
curl -X POST http://localhost:4000/auth/login \
-H "Content-Type: application/json" \
-d '{"email":"user@example.com","password":"secret","remember":false}'
Response includes access_token, refresh_token, expires_at, and user data.
With "remember": true, tokens are also set as HTTP-only cookies.
Authenticated Requests#
curl http://localhost:4000/auth/me \
-H "Authorization: Bearer <access_token>"
Protected API routes under /api/* use JWT middleware + ACL claims middleware.
Token Claims#
Access and refresh tokens include:
user_id,email,roles,session_idis_superuser(bool)type:"access"or"refresh"exp: expiration timestamp
Configuration#
# .env
JWT_SECRET=your-secret-change-in-production
ENABLE_REGISTER=true # optional; disabled by default
When APP_ENV=production, JWT_SECRET must be set or the server refuses to start.
Refresh Flow#
curl -X POST http://localhost:4000/auth/refresh \
-H "Content-Type: application/json" \
-d '{"refresh_token":"<refresh_token>"}'