Platform auth

Prefix: /api/auth. JSON {success, data|message}. Base URL https://api.tefily.com.

Method	Path	Auth	Description
POST	/api/auth/register	none	Register a platform user
POST	/api/auth/login	none	Login; returns platform JWT
GET	/api/auth/me	platform JWT or PAT	Current platform user
GET	/api/auth/oauth/providers	none	Enabled SSO providers
GET	/api/auth/oauth/:provider/start	none	Start Google / Microsoft / Apple
GET/POST	/api/auth/oauth/:provider/callback	none	IdP callback (Apple may POST)
POST	/api/auth/oauth/exchange	none	Exchange one-time SSO ticket for JWT
GET/POST	/api/auth/ssh-keys	platform	List / add SSH keys
DELETE	/api/auth/ssh-keys/:keyId	platform	Delete SSH key
GET/POST	/api/auth/api-keys	platform	List / create PATs (kfx_…)
DELETE	/api/auth/api-keys/:keyId	platform	Revoke PAT

Organizations (platform JWT or PAT):

Method	Path	Description
GET/POST	/api/organizations	List / create
GET/PUT/DELETE	/api/organizations/:orgId	Get / update / delete
GET/POST	/api/organizations/:orgId/members	Members
PUT/DELETE	/api/organizations/:orgId/members/:memberId	Role / remove
GET/PUT	.../members/:memberId/permissions	Direct grants
GET	.../members/:memberId/effective-permissions	Resolved permissions
GET	.../me/permissions	Caller’s permissions
GET/POST	.../teams	Teams
GET/POST	.../permission-groups	Permission groups

LLM credentials also live under org and project paths (llm-credentials, llm-settings, llm-models, llm-resolved).

Projects: GET/POST /api/projects, GET/PUT/DELETE /api/projects/:id.