Chat App’s backend exposes a REST API mounted atDocumentation Index
Fetch the complete documentation index at: https://mintlify.com/khushboodaryani/Chat-App/llms.txt
Use this file to discover all available pages before exploring further.
/api. The API is organised into three resource groups — auth, messages, and users — covering everything from account creation to real-time message delivery. Public auth endpoints require no credentials; every other endpoint is protected by a JWT stored in an HttpOnly cookie that is set automatically when a user signs up or logs in.
Base URL
| Environment | Base URL |
|---|---|
| Development | http://localhost:4000 |
| Production | Same origin as the frontend (relative paths work) |
4000. When the app is deployed the API and frontend share the same domain, so you can use relative paths like /api/auth/login from the client.
Authentication
Chat App uses JWT cookies for session management. On a successful signup or login the server callsgenerateTokenAndSetCookie, which writes a signed JWT into an HttpOnly cookie named jwt with a 15-day expiry. The browser attaches this cookie to every subsequent same-origin request automatically.
Protected routes run the protectRoute middleware, which reads req.cookies.jwt, verifies it with JWT_SECRET, and attaches the matching User document to req.user. No Authorization header is needed — the cookie is the only credential the API looks for.
| Cookie name | jwt |
|---|---|
| Storage | HttpOnly (not accessible via document.cookie) |
| Expiry | 15 days from issue |
| Scope | Same-site, same-origin |
Endpoint Inventory
| Method | Path | Auth Required | Description |
|---|---|---|---|
POST | /api/auth/signup | No | Register a new user account |
POST | /api/auth/login | No | Log in and receive a JWT cookie |
POST | /api/auth/logout | No | Log out and clear the JWT cookie |
GET | /api/messages/:id | Yes | Fetch conversation history with a user |
POST | /api/messages/send/:id | Yes | Send a message to a user |
GET | /api/users | Yes | List all users except the logged-in user |
Response Format
All endpoints return JSON. Successful responses return the requested resource or a confirmation object. Error responses always use the shape below, making it straightforward to render a single error handler on the client.200 for successful reads, 201 for successful resource creation, 400 for validation errors, 401/404 for auth/not-found failures, and 500 for unexpected server errors.
In development the
jwt cookie is not marked Secure, so it transmits over plain HTTP on localhost. When you deploy, set NODE_ENV=production and serve the app over HTTPS — the server will then add the Secure flag automatically.Explore the API
Authentication API
Signup, login, and logout endpoints with full request and response schemas.
Messages API
Send messages and retrieve conversation history between two users.
Users API
List all registered users to populate the sidebar contacts list.
WebSocket Events
Real-time
newMessage and online-status events delivered via Socket.io.