Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/nelrondon/backend-proyecto-estructuras/llms.txt

Use this file to discover all available pages before exploring further.

GET /api/verify-token is the canonical way to check whether a user’s session is still valid. It is protected by the authRequired middleware, which verifies the cookie’s signature before the handler ever runs. If the token is intact, the controller decodes the id from the payload, fetches the latest user record from the database, and returns it. This makes the endpoint suitable for bootstrapping your front-end on page load — a single call tells you both that the token is valid and delivers fresh profile data.

​
Endpoint

GET /api/verify-token
Authentication: Requires a valid token HTTP-only cookie. The authRequired middleware processes the cookie before the controller runs.

​
Request Body

No request body is required or accepted for this endpoint.

​
Authentication Flow

The request passes through two layers of verification:
  1. authRequired middleware — reads req.cookies.token, verifies the JWT signature with SECRET_KEY, and attaches the decoded payload to req.user. Rejects the request early if the token is absent or invalid.
  2. verifyToken controller — additionally re-reads req.cookies.token, calls verifyToken(token) to extract the id, then queries UserModel.find(id) to confirm the user still exists in the database.

​
Example Request

# Uses the cookie file saved during login
curl -b cookies.txt -s https://your-api.com/api/verify-token

​
Responses

​
200 — Valid Session

The token is valid, the user exists in the database, and the full profile is returned.
​
id
string
The user’s UUID.
​
name
string
The user’s full name.
​
username
string
The user’s username.
​
email
string
The user’s email address.
​
phone
string
The user’s phone number.
​
last_login
string
ISO 8601 timestamp of the user’s most recent login.
{
  "id": "a3f8c2d1-74be-4e2a-9f61-bb0123456789",
  "name": "John Doe",
  "username": "johndoe",
  "email": "john@example.com",
  "phone": "+1-800-555-1234",
  "last_login": "2024-11-01T18:45:22.310Z"
}

​
401 — No Token

Returned by the controller when req.cookies.token is falsy (absent or empty string). 
{
  "message": "No hay token en la petición"
}

​
401 — Invalid Token

Returned when jwt.verify() throws (expired or tampered signature) or when UserModel.find(id) returns no matching user. 
{
  "message": "Token inválido"
}
The authRequired middleware may intercept the request before the controller logic runs. In that case the error shape is slightly different: { "message": "No Token, Unauthorized" } (missing cookie) or { "message": "Invalid Token" } (bad signature), both with HTTP 401/403 respectively. Design your client to handle either shape for this endpoint.

​
Common Use Case

Call GET /api/verify-token once when your application initialises — for example in a React useEffect or a SvelteKit load function — to silently restore the user’s authenticated state from the persisted cookie: 
// Example: restore auth state on app boot
async function restoreSession() {
  try {
    const res = await fetch('https://your-api.com/api/verify-token', {
      credentials: 'include',
    });
    if (!res.ok) return null;          // Expired or no session
    return await res.json();           // { id, name, username, ... }
  } catch {
    return null;
  }
}

Build docs developers (and LLMs) love

Get started for freeTalk to us