Authentication

Bearer tokens for the HelixQA REST API.

All /api/v1 endpoints except registration, login and password reset require a bearer token.

POST /api/v1/auth/register  {"email": "you@company.com", "password": "..."}
POST /api/v1/auth/login     {"email": "you@company.com", "password": "..."}
# → {"access_token": "...", "token_type": "bearer"}

GET /api/v1/auth/me
Authorization: Bearer <access_token>

Token lifetime & storage

The web app keeps the token in sessionStorage (cleared when the tab closes) and clears it on 401. For scripts, store tokens in your secret manager — never in source control.

Password reset

POST /api/v1/auth/forgot-password with the email, then POST /api/v1/auth/reset-password with the token from the email and the new password.