Auth Service centralizes identity and access management for microservices architectures. Built with Spring Boot 3 and Clean Architecture, it issues short-lived JWT access tokens, rotates opaque refresh tokens with reuse detection, and supports federated login via Google and GitHub. Every endpoint is deny-all by default — only explicitly declared public routes are accessible without a valid token.Documentation Index
Fetch the complete documentation index at: https://mintlify.com/ricardomb-tech/auth-service/llms.txt
Use this file to discover all available pages before exploring further.
Quickstart
Register an account, verify your email, and obtain your first JWT in minutes.
API Reference
Full endpoint documentation — request/response schemas, status codes, and curl examples.
Configuration
Environment variables, JWT settings, and OAuth2 provider setup.
Architecture
Clean Architecture overview: domain, application, and infrastructure layers.
What Auth Service provides
Credential Authentication
Email + password registration, email verification, and login with JWT issuance.
Token Management
Access token validation, refresh token rotation, and family-level reuse detection.
Social Login (OAuth2)
One-click login with Google and GitHub. Federated identities link to existing accounts.
Password Reset
Secure, single-use password reset tokens with anti-enumeration responses.
Protecting Endpoints
How to validate JWTs in downstream services and configure role-based access.
Local Deployment
Docker Compose stack with PostgreSQL, MailHog, and Redpanda ready in one command.
How it works
Register and verify
Clients call
POST /auth/register to create an account. An email verification link is sent via MailHog (dev) or SMTP (prod). After confirming with POST /auth/verify, the account is active.Log in and obtain tokens
POST /auth/login validates credentials and returns a short-lived access token (JWT, 15 min) and a long-lived refresh token (opaque, 7 days). Social login via Google or GitHub follows the same flow through GET /oauth2/authorization/{provider}.Call protected endpoints
Include the access token as
Authorization: Bearer <token> on every request to protected endpoints. The JWT filter validates the signature and expiry; no server-side session is stored.Auth Service uses a deny-all security model — any new endpoint is private by default until explicitly listed as public in
SecurityConfig. See the Protecting Endpoints guide for integration details.