Register

Field	Required	Rules
name	Yes	2–100 characters
email	Yes	Valid email
password	Yes	8–128 characters
timezone	No	Up to 50 characters

{
  "success": true,
  "data": { "accessToken": "...", "refreshToken": "..." }
}

Login and Refresh

Login accepts email and password. Refresh accepts refreshToken and returns a new access/refresh pair. Access tokens last 15 minutes and refresh tokens last seven days.

Logout and Password

Logout requires bearer authentication plus the refresh token body and blocklists that refresh token. Password change accepts currentPassword and newPassword.

Profile

The profile response contains id, name, email, and timezone. The current update DTO accepts only optional name.

Password Reset

Forgot-password always returns a neutral success response. Reset accepts token and newPassword; tokens expire after one hour.

WooCommerce Plugin Key

These owner/admin routes return plugin-key metadata or rotate the key for an account with exactly one connected WooCommerce store. Multiple-store accounts reconnect from the specific plugin instead.

Verifier-bound Plugin Connection

Init is public and binds the store/callback origin to a verifier challenge. Complete requires owner/admin authentication and returns only a five-minute one-time code. The WordPress server exchanges that code plus its verifier; only this final server-to-server response reveals the store-bound key once.