Creates a new user account. On success, returns an access token in the response body and sets a refreshToken httpOnly cookie.
Endpoint
Authentication: None required
Request body
The user’s email address. Must be a valid email format and not already registered.
The user’s password. Must meet the minimum strength requirements enforced by the validation schema.
Response
true on a successful signup.
Human-readable result message. Value: "Account created successfully".
Short-lived JWT access token. Include this in the Authorization: Bearer header on subsequent requests.
MongoDB ObjectId of the newly created user.
The registered email address.
The user’s role. Value: "user" for standard accounts.
refreshToken cookie is also set on the response (httpOnly, secure, sameSite: none, scoped to /api/auth).
Error cases
| Status | Message | Cause |
|---|
400 | Validation error message | Missing or invalid request body fields |
400 | "Signup failed" | Email already registered or other service error |
Example
curl -X POST http://localhost:5000/api/auth/signup \
-H "Content-Type: application/json" \
-d '{
"email": "[email protected]",
"password": "SecurePass123!",
"name": "Alice Smith"
}'
{
"success": true,
"message": "Account created successfully",
"data": {
"accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"user": {
"id": "64f1a2b3c4d5e6f7a8b9c0d1",
"email": "[email protected]",
"name": "Alice Smith",
"role": "user"
}
}
}
{
"success": false,
"message": "Signup failed",
"statusCode": 400
}
