> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/Arvo-AI/aurora/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication Overview

> Learn how Aurora handles user authentication and authorization

## Overview

Aurora uses a credentials-based authentication system powered by Auth.js (formerly NextAuth.js). The authentication flow uses email/password credentials with secure bcrypt password hashing.

## Authentication Flow

1. **User Registration**: Users create an account with email, password, and optional name
2. **User Login**: Users authenticate with email and password
3. **Session Management**: Auth.js manages user sessions via the `X-User-ID` header
4. **API Authorization**: All API requests must include the `X-User-ID` header from the Auth.js session

## Security Features

* **Password Hashing**: Passwords are hashed using bcrypt with automatically generated salts
* **Timing Attack Prevention**: Login endpoint uses constant-time password verification
* **Session-based Auth**: Stateless authentication using Auth.js session management
* **CORS Protection**: Configurable CORS headers with credential support

## Authentication Headers

All authenticated API requests must include:

```bash theme={null}
X-User-ID: <user-id-from-session>
```

This header is automatically set by the Auth.js middleware on the frontend.

## Base URL

All authentication endpoints are under:

```
http://localhost:5080/api/auth
```

## Available Endpoints

<CardGroup cols={2}>
  <Card title="User Registration" icon="user-plus" href="/api/auth/register">
    Create a new user account
  </Card>

  <Card title="User Login" icon="right-to-bracket" href="/api/auth/login">
    Authenticate with email and password
  </Card>

  <Card title="Change Password" icon="key" href="/api/auth/token-management">
    Update user password
  </Card>
</CardGroup>

## Password Requirements

* Minimum length: 8 characters
* No complexity requirements (for user convenience)
* Stored as bcrypt hash with salt

## Error Handling

All authentication endpoints return JSON error responses:

```json theme={null}
{
  "error": "Error message description"
}
```

Common HTTP status codes:

* `200` - Success
* `201` - Created (registration)
* `400` - Bad request (validation error)
* `401` - Unauthorized (invalid credentials)
* `409` - Conflict (user already exists)
* `500` - Internal server error

## CORS Configuration

Authentication endpoints support CORS with:

* **Allowed Origins**: Dynamic based on request origin (defaults to `FRONTEND_URL`)
* **Allowed Methods**: `GET, POST, PUT, DELETE, OPTIONS`
* **Allowed Headers**: `Content-Type, X-Provider, X-Requested-With, X-User-ID, Authorization`
* **Credentials**: Supported (`Access-Control-Allow-Credentials: true`)