Authentication

The Trakli API uses Laravel Sanctum token authentication. You obtain a bearer token by registering or logging in, then send it on every authenticated request.

Base URL and versioning

Public, unauthenticated routes live at the root of /api. Authenticated resource routes live under /api/v1.

https://api.your-domain.example/api        # public routes
https://api.your-domain.example/api/v1     # authenticated routes

The response envelope

Every endpoint returns the same JSON envelope.

{
  "success": true,
  "message": "Operation successful",
  "data": {}
}

On failure, success is false and the body carries a message and, for validation errors, the offending fields.

{
  "success": false,
  "message": "The given data was invalid.",
  "errors": {
    "amount": ["The amount field is required."]
  }
}

List endpoints add pagination and sync metadata alongside data, including the last sync time and the page counters.

Get a token

Register or log in on the public auth routes. These are provided by the authentication layer and do not require a token.

# Register
curl -X POST https://api.your-domain.example/api/register \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@example.com",
    "password": "your-password-here"
  }'

# Log in
curl -X POST https://api.your-domain.example/api/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@example.com",
    "password": "your-password-here"
  }'

A successful login returns a bearer token in the response data. Store it securely; treat it like a password.

Use the token

Send the token in the Authorization header on every request to /api/v1.

curl https://api.your-domain.example/api/v1/user \
  -H "Authorization: Bearer your-token-here" \
  -H "Accept: application/json"

The middleware on these routes is auth:sanctum. A missing or invalid token returns 401 Unauthorized.

Other auth routes

The authentication layer also provides:

• POST /api/send-verification-code and POST /api/verify-code for email verification.
• POST /api/password/reset-code and POST /api/password/reset for password resets.
• POST /api/logout (authenticated) to revoke the current token.

Current user

To confirm a token works and to read the current account:

curl https://api.your-domain.example/api/v1/user \
  -H "Authorization: Bearer your-token-here"

HTTP status codes

Code	Meaning
200	Success
201	Created
401	Missing or invalid token
404	Not found
422	Validation failed
500	Server error