Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/ytabeloved/ordervista/llms.txt

Use this file to discover all available pages before exploring further.

Ordervista authenticates API requests using JSON Web Tokens (JWT) following the Bearer scheme. When a user logs in, the server signs a token containing their identity and role, then returns it to the client. Every subsequent request to a protected endpoint must include that token in the Authorization header. The verifyToken middleware validates the signature against the JWT_SECRET environment variable, and the authorizeRoles middleware checks the id_rol claim to enforce per-endpoint permissions.

​
Registering a New Account

Call POST /api/auth/register to create a new user account. New accounts are always assigned the Customer role (id_rol: 3). The nombre, apellido, email, and password fields are required; telefono is optional. 
curl -X POST https://ordervista-backend.onrender.com/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"nombre":"Jane","apellido":"Doe","email":"jane@example.com","password":"your_password"}'
Successful response — 201 Created 
{
  "mensaje": "Usuario registrado correctamente",
  "id_usuario": 7
}
Error responses
HTTP StatusmensajeCause
400"Debe completar los datos obligatorios"One or more required fields are missing
400"El correo ya se encuentra registrado"An account with that email already exists
500"Error al registrar usuario"Unexpected server error

​
Obtaining a Token

Call POST /api/auth/login with a valid email and password. The server looks up the account by email, verifies the submitted password against the stored bcrypt hash, and — on success — returns a signed JWT alongside the authenticated user’s profile. 
curl -X POST https://ordervista-backend.onrender.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@example.com","password":"your_password"}'
Successful response — 200 OK 
{
  "mensaje": "Inicio de sesión correcto",
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "usuario": {
    "id_usuario": 1,
    "nombre": "Admin",
    "apellido": "User",
    "email": "admin@example.com",
    "id_rol": 1
  }
}
Store the token value — you will need it for every protected request. Error responses
HTTP StatusmensajeCause
400"Debe ingresar correo y contraseña"email or password field is missing
401"Credenciales inválidas"Email not found or password does not match
500"Error al iniciar sesión"Unexpected server error

​
Using the Token

Include the token in the Authorization header of every request to a protected endpoint, prefixed with Bearer (note the trailing space). 
curl https://ordervista-backend.onrender.com/api/users \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."
Never embed tokens directly in source code or commit them to version control. Store them in environment variables on the server side, or in localStorage / a secure cookie on the client side.

​
Token Payload

Each token is signed with jwt.sign() using HS256 and contains the following claims:
ClaimTypeDescription
id_usuarionumberUnique identifier of the authenticated user
emailstringUser’s email address
id_rolnumberRole ID used by authorizeRoles to gate endpoint access
expnumberUnix timestamp at which the token expires (2 hours from issue)
The id_rol claim maps to the three system roles:
id_rolRole
1Admin
2Operator
3Customer
You can inspect a token’s claims without a library by decoding the Base64 middle segment, or use any JWT debugger. The signature itself is verified server-side only.

​
Error Responses

The verifyToken and authorizeRoles middleware return the following errors when authentication or authorisation fails:
HTTP StatusmensajeCause
401"Token no proporcionado"Authorization header is absent
401"Token inválido o expirado"Signature verification failed or token has expired
401"Usuario no autenticado"req.user was not set before authorizeRoles ran
403"No tiene permisos para acceder a este recurso"Token is valid but id_rol is not in the allowed roles for this endpoint
A 403 response means your credentials are valid but your role does not permit the action. Logging in with a different account that holds the correct role is the only remedy — do not retry the same request expecting a different outcome.

​
Token Expiry

Tokens are valid for 2 hours from the moment they are issued (configured as expiresIn: "2h" in generateToken.js). After expiry, any request carrying that token returns: 
{
  "mensaje": "Token inválido o expirado"
}
When this occurs, re-authenticate by calling POST /api/auth/login again to receive a fresh token. There is no refresh-token mechanism — a full login is required.

​
Logout

Call POST /api/auth/logout to signal the end of a session: 
curl -X POST https://ordervista-backend.onrender.com/api/auth/logout \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."
Response — 200 OK 
{
  "mensaje": "Sesión cerrada correctamente"
}
Because JWTs are stateless, the server does not maintain a token denylist. Token invalidation is handled client-side: upon receiving a successful logout response, remove the token from localStorage (or whichever client storage mechanism you use) so it cannot be reused.
If a token is stolen before it expires, there is currently no server-side mechanism to revoke it. Keep tokens short-lived, transmit them only over HTTPS, and clear them immediately on logout.

Build docs developers (and LLMs) love

Get started for freeTalk to us