Authentication

How to authenticate.

Cookie-Based (Primary)

Recommended

Most API routes use HttpOnly session cookies (ai-bradaa-session). Set automatically after OTP verification. Include credentials: "include" in fetch requests.

OTP Code

Passwordless

POST /api/auth/otp/send with { email }. User receives a 6-character code. POST /api/auth/otp/verify with { email, otp } to authenticate.

Passkeys (WebAuthn)

Secure

Register and authenticate via WebAuthn for biometric, phishing-resistant sign-in. Requires a registered passkey and supported device.

Endpoints

Public API routes.

9 public endpoints for authentication and user management.

MethodPathDescriptionRate Limit
POST/api/auth/otp/sendSend OTP code to email address5 per email, 10 per IP
POST/api/auth/otp/verifyVerify OTP code and create session10 per IP
GET/api/auth/otp/sessionCheck current session status100 per IP
POST/api/auth/logoutEnd session and clear cookies10 per IP
GET/api/user/meGet current user profile100 per user
PUT/api/user/settingsUpdate user preferences50 per user
GET/api/user/conversationsList user conversation history100 per user
POST/api/newsletter/subscribeSubscribe email to newsletter3 per email
GET/api/healthPublic system health checkNone

Code Examples

Quick start.

session.js
// Check session status
const res = await fetch("/api/auth/otp/session", {
  credentials: "include"
});
const data = await res.json();
// { authenticated: true, user: { email, tier } }
user.js
// Get user profile
const res = await fetch("/api/user/me", {
  credentials: "include"
});
const user = await res.json();
// { email, tier }
newsletter.js
// Subscribe to newsletter
const res = await fetch("/api/newsletter/subscribe", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ email: "you@example.com" })
});
const data = await res.json();
// { success: true }

Rate Limits

Fair usage policy.

Free

OTP5/email, 10/IP
API100/IP
User100/user

Pro

OTP10/email, 20/IP
API500/IP
User500/user

Ultimate

OTP20/email, 50/IP
API2000/IP
User2000/user

Need more details?

Contact our team for full API documentation, SDK guides, and enterprise integration support.