Authentication

The Face2Social API uses JWT Bearer Tokens for authentication. This guide explains how to register, sign in, and use your token.

Sign Up

Create a new account with POST /auth/signup.

curl -X POST https://dashboard.face2social.com/api/v1/auth/signup \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "your-password", "token": "<recaptcha-token>"}'

The token field (a reCAPTCHA token string) is required in the signup request body, so sign-up is meant to run from a browser. Optional fields: promocode and tracking_code (the ?trk= value of a partner link).

On success (200 OK) the response sets a session cookie. Signup has no way to request a JWT in the body (here token is the reCAPTCHA string), so API clients call POST /auth/signin with "token": true after signing up.

Sign In

Authenticate with an existing account via POST /auth/signin.

curl -X POST https://dashboard.face2social.com/api/v1/auth/signin \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "your-password", "token": true}'

The token boolean field instructs the API to include the JWT in the response body. The response contains a token field only when token: true is sent — otherwise authentication works via the session cookie set by the response. Save the token and send it as a Bearer token on every authenticated request.

Using the Token

Include the token in the Authorization header:

curl https://dashboard.face2social.com/api/v1/users/me \
  -H "Authorization: Bearer <your-token>"

Public Endpoints

Some endpoints are public and do not require a token:

Endpoint	Purpose
POST /auth/signup	Register
POST /auth/signin	Sign in
POST /auth/recovery	Request password recovery email
GET /auth/recovery/{hash}	Check recovery hash validity
POST /auth/recovery/{hash}	Confirm password recovery (set new password)
POST /auth/confirm/{hash}	Confirm email address
POST /auth/google	Google OAuth sign in
POST /landing/email	Landing page email collection
POST /optout	Submit opt-out request (compliance)
GET /subscription/plans	List subscription plans
POST /ref/{code}	Save a referral or partner code to the session
GET /offer/{hash}	Resolve an offer link from an email
GET/POST /settings/account/delete/{hash}	Check / confirm account deletion from the emailed link

Google OAuth

Use POST /auth/google with {"clientId": "...", "credential": "<Google credential>"} to sign in or register via Google. Like sign-in, the response body contains a JWT only when the request also sets "token": true.

DELETE /auth/google (authenticated) unlinks the Google account from the current user.

Password Recovery

1. POST /auth/recovery — sends a recovery email to the address on file.
2. GET /auth/recovery/{hash} — validates that the recovery link is still valid.
3. POST /auth/recovery/{hash} with {"password": "<new password>"} — sets the new password.

Sign Out

POST /auth/signout invalidates the current session. No request body needed; send the Bearer token as usual.

Get Current User Info

GET /users/me (or GET /auth/info) returns the current authenticated user (User). Besides the profile, it tells a client what it may do next:

Field	Meaning
credits	The same CreditsInfo object as GET /credits.
canSearch	false when the user must buy a plan before starting another search. Treat only an explicit false as blocking; a missing field means allowed.
paymentStage	selection or results — which search step charges the credit (see Subscription and Credits). Missing or null means selection.
offer	Unix time when the user's current discount offer expires, if one is active.

Session Cookie

When sign-in or sign-up succeeds, the API also sets a session cookie. Browser clients can rely on the cookie for subsequent requests (the backend reads either the cookie or the Authorization header). Non-browser clients should use the Bearer token exclusively.