Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/khushboodaryani/Chat-App/llms.txt

Use this file to discover all available pages before exploring further.

Chat App’s authentication layer is built around three stateless endpoints that create, verify, and destroy user sessions. All session state lives in a single HttpOnly cookie named jwt — there are no refresh tokens, no session store, and no Authorization header to manage. A successful signup or login call sets the cookie automatically; logout clears it by setting its maxAge to 0.

​
POST /api/auth/signup

Creates a new user account, generates a gender-appropriate avatar URL via the Iran Liara avatar service, hashes the password with bcrypt, and responds with the new user’s public profile. The JWT cookie is set in the same response.

​
Request body

​
fullName
string
required
The user’s display name shown in the chat sidebar and conversation header. Accepts any non-empty string.
​
username
string
required
A unique handle used for login. Must not already exist in the database — the server returns 400 if a duplicate is found.
​
password
string
required
The account password. Must be at least 6 characters long. Stored as a bcrypt hash; never returned in any response.
​
confirmPassword
string
required
Must exactly match password. The server compares the two fields before hashing; a mismatch returns a 400 error immediately.
​
gender
string
required
Must be either "male" or "female". Controls which avatar URL is auto-generated for the new account.
Request body example
{
  "fullName": "Khushboo Daryani",
  "username": "khushboo",
  "password": "secret123",
  "confirmPassword": "secret123",
  "gender": "female"
}

​
Response — 201 Created

The JWT cookie is set alongside this JSON body. The password field is never included in any response.
​
_id
string
The MongoDB ObjectId of the newly created user, represented as a 24-character hex string.
​
fullName
string
The full name provided during signup.
​
username
string
The unique username provided during signup.
​
profilePic
string
An auto-generated avatar URL from avatar.iran.liara.run, personalised by username and gender.
201 Response
{
  "_id": "664f1c2e8b3a4c0012ef9abc",
  "fullName": "Khushboo Daryani",
  "username": "khushboo",
  "profilePic": "https://avatar.iran.liara.run/public/girl?username=khushboo"
}

​
Error responses

HTTP Statuserror valueCause
400"Passwords don't match"password and confirmPassword differ
400"Username already exists"Another account uses this username
400"Invalid user data"Mongoose failed to construct the new User document
500"Internal Server Error"Unexpected server-side exception

​
POST /api/auth/login

Validates the supplied credentials against the stored bcrypt hash and, on success, issues a fresh JWT cookie. The response body is identical in shape to the signup response.

​
Request body

​
username
string
required
The username registered during signup. Case-sensitive.
​
password
string
required
The plain-text password. Compared against the stored bcrypt hash with bcrypt.compare.
Request body example
{
  "username": "khushboo",
  "password": "secret123"
}

​
Response — 200 OK

​
_id
string
The MongoDB ObjectId of the authenticated user.
​
fullName
string
The user’s full name.
​
username
string
The user’s unique username.
​
profilePic
string
The user’s avatar URL.
200 Response
{
  "_id": "664f1c2e8b3a4c0012ef9abc",
  "fullName": "Khushboo Daryani",
  "username": "khushboo",
  "profilePic": "https://avatar.iran.liara.run/public/girl?username=khushboo"
}

​
Error responses

HTTP Statuserror valueCause
400"Invalid username or password"Username not found or password hash mismatch
500"Internal Server Error"Unexpected server-side exception

​
POST /api/auth/logout

Ends the current session by overwriting the jwt cookie with an empty value and maxAge: 0, which instructs the browser to delete it immediately. No request body is required.

​
Request body

None.

​
Response — 200 OK

​
message
string
Always "Logged out successfully" on success.
200 Response
{
  "message": "Logged out successfully"
}

​
Error responses

HTTP Statuserror valueCause
500"Internal Server Error"Unexpected server-side exception
All three endpoints manage the jwt cookie on your behalf. The frontend never needs to read, store, or manually attach a token — the browser handles cookie transmission automatically on every same-origin request.

Build docs developers (and LLMs) love

Get started for freeTalk to us