Authentication API

const response = await fetch('/api/auth/register', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    name: 'Johan Lepinay',
    email: 'johan@yanipay.com',
    password: 'SecureP@ss123',
  }),
});

const data = await response.json();
// Returns: { user: { id, name, email }, token: 'jwt...' }

1
{
2
  "user": {
3
    "id": "usr_a1b2c3d4e5f6",
4
    "name": "Johan Lepinay",
5
    "email": "johan@yanipay.com",
6
    "role": "USER",
7
    "createdAt": "2026-02-20T10:30:00Z"
8
  },
9
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
10
  "expiresIn": 86400
11
}

const response = await fetch('/api/auth/signin', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    email: 'johan@yanipay.com',
    password: 'SecureP@ss123',
  }),
});

const { user, token } = await response.json();

{
  "user": {
    "id": "usr_a1b2c3d4e5f6",
    "name": "Johan Lepinay",
    "email": "johan@yanipay.com",
    "role": "USER",
    "image": "https://avatars.githubusercontent.com/..."
  },
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresIn": 86400,
  "refreshToken": "rt_x1y2z3..."
}

import { auth } from '@/auth';

export default async function ProtectedPage() {
  const session = await auth();

  if (!session) {
    redirect('/auth/signin');
  }

  return (
    <div>
      <h1>Bienvenue, {session.user.name}</h1>
      <p>Role: {session.user.role}</p>
    </div>
  );
}

const response = await fetch('/api/auth/session', {
  credentials: 'include',
});

const session = await response.json();

if (session?.user) {
  console.log(`Connecte en tant que ${session.user.email}`);
  console.log(`Role: ${session.user.role}`);
} else {
  console.log('Non authentifie');
  window.location.href = '/auth/signin';
}

const response = await fetch('/api/auth/refresh', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    refreshToken: 'rt_x1y2z3...',
  }),
});

const { token, expiresIn } = await response.json();
// New JWT token with fresh expiry

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresIn": 86400,
  "refreshToken": "rt_new_a1b2c3..."
}

const response = await fetch('/api/auth/me', {
  headers: {
    'Authorization': `Bearer ${token}`,
  },
});

const { user } = await response.json();

1
{
2
  "user": {
3
    "id": "usr_a1b2c3d4e5f6",
4
    "name": "Johan Lepinay",
5
    "email": "johan@yanipay.com",
6
    "role": "ADMIN",
7
    "image": "https://avatars.githubusercontent.com/...",
8
    "emailVerified": "2026-01-15T08:00:00Z",
9
    "createdAt": "2026-01-01T00:00:00Z",
10
    "updatedAt": "2026-02-20T10:30:00Z",
11
    "preferences": {
12
      "language": "fr",
13
      "currency": "EUR",
14
      "notifications": true
15
    },
16
    "accounts": [
17
      {
18
        "provider": "github",
19
        "linkedAt": "2026-01-01T00:00:00Z"
20
      },
21
      {
22
        "provider": "google",
23
        "linkedAt": "2026-01-05T00:00:00Z"
24
      }
25
    ]
26
  }
27
}

import { signIn } from 'next-auth/react';

// GitHub OAuth
await signIn('github', { callbackUrl: '/dashboard' });

// Google OAuth
await signIn('google', { callbackUrl: '/dashboard' });

// Email/Password via NextAuth
await signIn('credentials', {
  email: 'johan@yanipay.com',
  password: 'SecureP@ss123',
  redirect: false,
});

1
{
2
  "sub": "usr_a1b2c3d4e5f6",
3
  "email": "johan@yanipay.com",
4
  "name": "Johan Lepinay",
5
  "role": "ADMIN",
6
  "iat": 1740048600,
7
  "exp": 1740135000,
8
  "iss": "yanipay.com",
9
  "aud": "yanipay-api"
10
}

import { getCurrentUser } from '@/lib/auth';

export async function GET() {
  const authResult = await getCurrentUser();

  if (!authResult.success || !authResult.user) {
    return NextResponse.json(
      { error: 'Unauthorized' },
      { status: 401 }
    );
  }

  const { userId, email, role } = authResult.user;
  // Proceed with authenticated operations...
}

1
import { getCurrentUser } from '@/lib/auth';
2
import { checkRateLimit, apiRateLimit } from '@/lib/rate-limit';
3
import { unauthorizedResponse, forbiddenResponse, createApiResponse } from '@/lib/api/response';
4
5
export async function GET(req: NextRequest) {
6
  // Rate limiting
7
  const rl = checkRateLimit(req, apiRateLimit);
8
  if (!rl.success) {
9
    return NextResponse.json({ error: 'Too many requests' }, { status: 429 });
10
  }
11
12
  // Authentication — TOUJOURS getCurrentUser(), jamais auth() de next-auth
13
  const auth = await getCurrentUser(req);
14
  if (!auth.success || !auth.user) {
15
    return unauthorizedResponse();
16
  }
17
18
  // RBAC — roles Prisma exacts, ADMIN toujours inclus
19
  const allowedRoles = ['PARTICULIER', 'ADMIN'];
20
  if (!allowedRoles.includes(auth.user.role ?? '')) {
21
    return forbiddenResponse();
22
  }
23
24
  return createApiResponse({ data: {} });
25
}

import { auth } from '@/auth';
import { NextResponse } from 'next/server';

export default auth((req) => {
  const isLoggedIn = !!req.auth;
  const isProtected = req.nextUrl.pathname.startsWith('/dashboard');

  if (isProtected && !isLoggedIn) {
    return NextResponse.redirect(new URL('/auth/signin', req.url));
  }

  return NextResponse.next();
});

export const config = {
  matcher: ['/dashboard/:path*', '/api/billing/:path*'],
};

{
  "error": "Invalid credentials",
  "code": "AUTH_INVALID_CREDENTIALS",
  "message": "Email or password is incorrect",
  "retryAfter": null
}

{
  "error": "Too many requests",
  "code": "AUTH_RATE_LIMIT",
  "message": "Too many login attempts. Please try again in 60 seconds.",
  "retryAfter": 60
}