End-user auth

Project auth is opt-in. Toggle it in Kallax (or POST /api/projects/:projectId/auth/toggle). Tefily creates a _users collection.

This is not the same as signing in to app.tefily.com. Console users have platform JWTs. App users have project JWTs (type: project).

Register and login

const auth = await client.auth.register({
  email: '[email protected]',
  password: 'secret123',
  extraFields: { name: 'Jane' },
});

await client.auth.login({ email: '[email protected]', password: 'secret123' });
console.log(client.token);

const me = await client.auth.me();

The client stores the JWT and sends Authorization: Bearer on later requests.

REST:

Method	Path
POST	/api/p/:projectId/auth/register
POST	/api/p/:projectId/auth/login
GET	/api/p/:projectId/auth/me

Register and login are public when auth is enabled. me requires a project JWT.

Access rules

After auth is on, put requireAuth (and owner compares) on every collection method your app uses. See Access rules.

Verify on your backend

Your server should not trust a project JWT without checking it. Use a service token and POST /api/p/:projectId/auth/verify with { "token": "<project jwt>" }. The response is { valid, user? }.

Mint a JWT from the console

Admins can mint a project-user JWT (POST /api/projects/:projectId/users/:userId/token) for the API tester. Do not use that as a substitute for login in production apps.