---
title: Authentication
description: Register, log in, and send authenticated requests to the TaskSocial API.
url: https://tasksocial-docs.thally.app/api/authentication
---

# Authentication

Register, log in, and send authenticated requests to the TaskSocial API.

TaskSocial uses JWT-based authentication with an HTTP-only cookie named `tokenName`.

You do not need to generate an API key manually. After a successful login, the server sets the cookie. Your HTTP client must retain and send it when making requests to protected endpoints.

## Authentication flow

```text
Register
   ↓
Log in
   ↓
Server verifies credentials
   ↓
JWT is stored in the tokenName cookie
   ↓
Client sends cookie with protected requests
   ↓
Server verifies JWT
   ↓
Request continues
```

## Register a user

Send a `POST` request to `/api/v1/auth/register` with a username, email address, and password.

```bash
curl -i -X POST \
  "https://tasksocial-p2cw.onrender.com/api/v1/auth/register" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "example-user",
    "email": "you@example.com",
    "password": "replace-with-a-strong-password"
  }'
```

A successful registration returns `201 Created`.

Use a unique email address when testing registration. If the request returns `400 Bad Request`, check that all required fields are present and that the email address has not already been registered.

## Log in

Send a `POST` request to `/api/v1/auth/login`:

```bash
curl -i -c cookies.txt \
  -X POST \
  "https://tasksocial-p2cw.onrender.com/api/v1/auth/login" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@example.com",
    "password": "replace-with-your-password"
  }'
```

A successful login returns `200 OK` and sets the `tokenName` cookie.

The `-c cookies.txt` option saves the cookie to a local file. Keep this file private because it contains authentication information.

## Make an authenticated request

Send the saved cookie with a protected request:

```bash
curl -i -b cookies.txt \
  "https://tasksocial-p2cw.onrender.com/api/v1/tasks/my-tasks"
```

The `-b cookies.txt` option sends the saved cookie. If the cookie is valid, the API returns the authenticated user's tasks.

## Log out

Send a `POST` request to `/api/v1/auth/logout`:

```bash
curl -i -b cookies.txt \
  -X POST \
  "https://tasksocial-p2cw.onrender.com/api/v1/auth/logout"
```

The server clears the authentication cookie.

## Authentication and authorization

Authentication verifies the user's identity. Authorization determines whether the authenticated user can perform an operation.

For TaskSocial, task creation, task retrieval, feed access, updates, and deletions require authentication. Updates and deletions also check task ownership.

## Troubleshooting

### `400 Bad Request`

Check the request body and credentials. During registration, make sure all required fields are included and the email is not already registered.

### `401 Unauthorized`

Log in again, check that the cookie file was created, and make sure the protected request includes it.

### `403 Forbidden`

For task updates and deletions, check that the task belongs to the authenticated user.

## Security notes

- Do not commit `cookies.txt` or share its contents.
- Do not place real passwords in public documentation, source code, or screenshots.
- Use test credentials when demonstrating requests.
- The cookie is HTTP-only, so browser JavaScript cannot directly read the token.

For the complete list of operations and schemas, return to the [API overview](/api/introduction).