Authentication Overview

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/SmartEatAI/smart-eat-ai/llms.txt

Use this file to discover all available pages before exploring further.

​

How Authentication Works

​

Authentication Flow

1. Register or Login to receive an access token
2. Include the token in the Authorization header of your requests
3. The token is validated on each request to protected endpoints
4. Tokens expire after a configured period and must be refreshed

​

JWT Tokens

• Subject (sub): The user’s email address
• Expiration (exp): Token expiration timestamp
• Algorithm: HS256 (HMAC with SHA-256)

​

Bearer Token Format

Authorization: Bearer <access_token>

​

Example Request

curl -X GET "https://api.smarteat.ai/auth/me" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

​

Including Tokens in Requests

​

cURL Example

curl -X GET "https://api.smarteat.ai/auth/me" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

​

JavaScript/Fetch Example

fetch('https://api.smarteat.ai/auth/me', {
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  }
})

​

Python Example

import requests

headers = {
    'Authorization': f'Bearer {access_token}',
    'Content-Type': 'application/json'
}

response = requests.get('https://api.smarteat.ai/auth/me', headers=headers)

​

Token Expiration

{
  "detail": "Invalid or expired token"
}

​

Security Best Practices

• Store tokens securely (e.g., secure HTTP-only cookies, encrypted storage)
• Use HTTPS for all API requests
• Implement token refresh mechanisms in production applications
• Never commit tokens to version control
• Rotate your SECRET_KEY regularly in production

​

Protected Endpoints

• /auth/me - Get current user information
• /profiles/* - All profile management endpoints
• /plans/* - All meal plan endpoints
• /daily-menus/* - All daily menu endpoints

​

Error Responses

​

401 Unauthorized

{
  "detail": "Invalid or expired token"
}

​

403 Forbidden

{
  "detail": "Not authorized to access this resource"
}