Users and Auth API

NextAuth flow and user profile endpoint contracts.

Auth routing

/api/auth/[...nextauth] is managed by NextAuth v5 (Auth.js) using Google OAuth and JWT session strategy.

Endpoint details

Purpose

Handles login, logout, and session callbacks via NextAuth route conventions.

Notes

  • Session values are consumed by protected API routes.
  • Provider credentials and callback URL are environment-driven.

Authorization baseline

Authentication answers who the caller is. Authorization checks whether the caller can act on a specific group or billing resource.