> ## Documentation Index
> Fetch the complete documentation index at: https://docs.uknvas.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Session tokens for people in the dashboard, API keys for your backend.

**Dashboard (people)** — `Authorization: Bearer <session token>` from the sign-in
flow. Routes are under `/organizations/:orgId/…` and checked against the
member's role.

**Server-to-server (your backend)** — `Authorization: Bearer gtt_…_sk_…` or
`X-API-Key: gtt_…_sk_…`. The key acts for one organisation and only within its
scopes. Never put a key in browser or mobile code; browsers cannot send
`X-API-Key` to this API.

## Sign-in (`/auth`)

| Method | Path | Body | Notes |
| - | - | - | - |
| POST | `/auth/register` | `email, password, firstName?, lastName?` | 202. Emails a 6-digit code. Same reply whether or not the email exists. |
| POST | `/auth/verify-email` | `email, code` | |
| POST | `/auth/resend-verification` | `email` | |
| POST | `/auth/login` | `email, password` | Returns `requiresOtp: true` and emails a code. |
| POST | `/auth/verify-login` | `email, code` | Returns `{ token, expiresIn, user, organizations }`. |
| POST | `/auth/forgot-password` | `email` | Emails a reset link (30 min). |
| POST | `/auth/reset-password` | `email, token, password` | Signs out every session. |
| GET | `/auth/me` | | |
| POST | `/auth/sign-out-everywhere` | | |

Passwords: 10+ characters with at least one lowercase letter, one uppercase
letter, one number and one special character. Codes expire after 10 minutes and die after 5 wrong attempts.
**Sandbox:** emails ending `@puzo.com` always get code `123456`.

## API key scopes

A key can carry any of: `wallets:read`, `wallets:fund`, `billing:read`, `hotels:read`,
`hotels:book`, `giftcards:read`, `giftcards:purchase`. Each route lists the scope it needs.
Keys are created, rotated and revoked under [Organisations](https://docs.uknvas.com/organisations.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.