Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/luiss811/Backend-Airguide/llms.txt

Use this file to discover all available pages before exploring further.

This is step 2 of the AirGuide login flow. After calling POST /api/auth/login and receiving an OTP in your email, submit that code here to complete authentication. On success, you receive a signed JWT token to use on all subsequent requests. If you did not receive the code or it expired, use the resend endpoint described below.

​
Verify your OTP

​
Endpoint

POST /api/auth/verify-2fa

​
Request body

​
correo
string
required
Your registered email address. Use the correo value returned by POST /api/auth/login.
​
codigo
string
required
The 6-digit OTP code delivered to your email. Codes are single-use and expire after a short window.

​
Response

​
token
string
A signed JWT Bearer token. Include this in the Authorization header of every protected request.
​
usuario
object
The authenticated user record.

​
Example

curl -X POST https://your-api.example.com/api/auth/verify-2fa \
  -H "Content-Type: application/json" \
  -d '{
    "correo": "estudiante@universidad.edu",
    "codigo": "847291"
  }'

​
Using the token

Include the token in the Authorization header of every request to a protected endpoint: 
curl https://your-api.example.com/api/some-endpoint \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
Requests without a valid token receive 401 Unauthorized. Requests to admin-only endpoints with a non-admin token receive 403 Forbidden.

​
Resend an OTP

If your code expired or you did not receive it, request a fresh OTP without going back through the login step.

​
Endpoint

POST /api/auth/resend-otp

​
Request body

​
correo
string
required
Your registered email address.

​
Response

​
message
string
A confirmation string. Returns "Nuevo código enviado a tu correo electrónico." on success. Returns "Si el correo existe, recibirás un nuevo código." if the account is not found or not active — this prevents email enumeration.

​
Example

curl -X POST https://your-api.example.com/api/auth/resend-otp \
  -H "Content-Type: application/json" \
  -d '{
    "correo": "estudiante@universidad.edu"
  }'
Resending a code invalidates all previous unused OTPs for your account. Only the most recently issued code is valid.

Build docs developers (and LLMs) love

Get started for freeTalk to us