AirGuide’s authentication system protects all API routes with JSON Web Tokens (JWT). Every account goes through an admin-approval step before it can log in, and every login requires a two-factor OTP verification before a token is issued. This page explains how accounts work, what roles exist, and how to move through the full flow.Documentation Index
Fetch the complete documentation index at: https://mintlify.com/luiss811/Backend-Airguide/llms.txt
Use this file to discover all available pages before exploring further.
Bearer token usage
After completing the two-factor verification, you receive a JWT token. Include it in theAuthorization header of every protected request:
401 Unauthorized.
Account states
New accounts start in thependiente state. An admin must approve each account before it can log in.
| State | Description |
|---|---|
pendiente | Registered but not yet approved by an admin. |
activo | Approved — can log in and receive a JWT. |
rechazado | Rejected by an admin. Login is blocked. |
Roles
The middleware exposes four roles on every authenticated request:| Role | Description |
|---|---|
alumno | Default role assigned on registration. |
profesor | Faculty member. |
rector | Rector-level access. |
admin | Full administrative access — can approve accounts, list all users, and manage the platform. |
admin role can access endpoints protected by the requireAdmin middleware (for example, GET /api/auth/pending and PUT /api/auth/validate/:id).
Full authentication flow
Register
Send
POST /api/auth/register with your email, password, full name, and optional student ID. Your account is created with estado: "pendiente" and rol: "alumno".Wait for admin approval
An admin reviews your account and calls
PUT /api/auth/validate/:id to set your estado to activo. You cannot log in until this step is complete.Log in and request an OTP
Send
POST /api/auth/login with your email and password. If your credentials are valid and your account is active, a 6-digit OTP is sent to your email address.Verify the OTP
Send
POST /api/auth/verify-2fa with your email and the OTP code. The code is single-use and expires after a short window.Receive a JWT token
On successful OTP verification, the response includes a
token string and your user object. The token is a signed JWT Bearer token.Explore the auth endpoints
Register
Create a new AirGuide account.
Login
Step 1 — submit credentials and receive an OTP.
Two-factor verification
Step 2 — verify your OTP and receive a JWT.
Password reset
Reset your password via a one-time email code.