Skip to main content

API

Kong terminates the public prefix. Upstream paths below do not include /api.

  • AuthController /v1/auth — identifier checks, register, login, OAuth, refresh, logout, sessions, account lifecycle, password and email OTP.
  • TrialRegistrationController POST /v1/auth/trial-registrations.
  • AccountDeletionRequestController and AccountClosureController — deletion and closure OTP.
  • PaymentProfileController /v1/auth/me/payment-profile.
  • Admin controllers under /v1/admin/* for users, trials, and ops backups.
  • Internal controllers under /internal/v1/auth/* for other services. These routes are not public Kong routes.

The HTTP contract is OpenAPI. When a route changes, update splick-backend/openapi/openapi.yaml in the same change as the controller.

Auth​

  • Public user routes expect a bearer access token issued by auth-service. Kong does not validate the JWT.
  • Service-to-service routes use INTERNAL_API_KEY. Do not document or commit the value.
  • Rate limits for auth-sensitive routes are declared per route in splick-backend/infra/kong/kong.yml.