Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/Emmanuel-Mtz-777/TechStore-Explorer/llms.txt

Use this file to discover all available pages before exploring further.

The TechStore Explorer API uses Laravel Sanctum personal access tokens for authentication. Obtain a token by registering a new account or logging in with an existing one, then include it in the Authorization header of every subsequent request that targets a protected endpoint. Tokens are stored in the personal_access_tokens table and remain valid until manually revoked.

​
POST /api/register

Creates a new user account with the customer role and immediately returns a Bearer token. Use this token to begin making authenticated requests without a separate login step. Request headers
HeaderValue
Content-Typeapplication/json
Acceptapplication/json
Request body
​
name
string
required
The user’s display name. Maximum 255 characters.
​
email
string
required
A unique email address for the account. Must be a valid email format and not already registered.
​
password
string
required
The account password. Minimum 8 characters.
Success response — 201 Created 
{
  "message": "User registered successfully",
  "user": {
    "id": 3,
    "name": "Jane Doe",
    "email": "jane@example.com",
    "role_id": 2
  },
  "token": "1|abc123..."
}
​
message
string
Human-readable confirmation — always "User registered successfully" on success.
​
user
object
The newly created user object. role_id will correspond to the customer role.
​
token
string
The plain-text Sanctum personal access token. Store this securely — it will not be shown again.
curl example 
curl -s -X POST http://127.0.0.1:8000/api/register \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "name": "Jane Doe",
    "email": "jane@example.com",
    "password": "supersecret"
  }'

​
POST /api/login

Authenticates an existing user and returns a fresh Bearer token. Each successful login creates a new personal access token named api-token. Request headers
HeaderValue
Content-Typeapplication/json
Acceptapplication/json
Request body
​
email
string
required
The email address associated with the account.
​
password
string
required
The account password.
Success response — 200 OK 
{
  "message": "Login successful",
  "user": {
    "id": 1,
    "name": "admin ",
    "email": "admin@example.com",
    "role_id": 1
  },
  "token": "2|xyz789..."
}
​
message
string
Human-readable confirmation — always "Login successful" on success.
​
user
object
The authenticated user object including their role_id.
​
token
string
A fresh plain-text Sanctum personal access token. Use this value in the Authorization header for all subsequent protected requests.
Error response — 401 Unauthorized Returned when the email does not exist or the password does not match. 
{
  "message": "Invalid credentials"
}
curl example 
curl -s -X POST http://127.0.0.1:8000/api/login \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "email": "admin@example.com",
    "password": "admin123"
  }'

​
Using the Token

Once you have a token, include it in the Authorization header as a Bearer token on every request to a protected endpoint. The header value must use the exact format Bearer {token} — note the space between Bearer and the token string. 
Authorization: Bearer 2|xyz789...
curl example — authenticated request to GET /api/wishlist 
curl -s -X GET http://127.0.0.1:8000/api/wishlist \
  -H "Accept: application/json" \
  -H "Authorization: Bearer 2|xyz789..."
Postman instructions
  1. Open your request in Postman.
  2. Click the Authorization tab.
  3. Set the Auth Type dropdown to Bearer Token.
  4. Paste your token into the Token field.
  5. Postman will automatically add the Authorization: Bearer {token} header to the request.
In Postman, save your token as an environment variable (e.g. {{token}}) and reference it in the Bearer Token field as {{token}}. This way you only need to update one place when your token changes.

​
Admin Access

Some endpoints require the authenticated user to hold the admin role in addition to a valid token. All /api/roles/* endpoints are protected by the admin.api middleware, which checks that $request->user()->role->name === 'admin'.
If you call an admin-only endpoint with a customer token, the API returns 403 Forbidden — even though your token itself is valid. You must log in as a user with the admin role to access role management endpoints.
403 Forbidden response when using a non-admin token: 
{
  "message": "Forbidden"
}
To obtain an admin-level token, log in with the seeded admin account: 
curl -s -X POST http://127.0.0.1:8000/api/login \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "email": "admin@example.com",
    "password": "admin123"
  }'

​
Test Credentials

The database seeder provisions two ready-to-use accounts for local development and testing.
EmailPasswordRoleAccess level
admin@example.comadmin123adminFull access — all endpoints including /api/roles/*
test@example.comcustomer123customerWishlist endpoints only (/api/wishlist)
These credentials are seeded by DatabaseSeeder and are only intended for local development. Do not use them in a production environment.

Build docs developers (and LLMs) love

Get started for freeTalk to us