Platform auth

Prefix: /api/auth. JSON {success, data|message}. Base URL https://api.tefily.com.

This is console auth (platform users). App users register and reset passwords on the dynamic project API (/api/p/:projectId/:databaseId/auth/...).

Method	Path	Auth	Description
POST	/api/auth/register	none	Register a platform user
POST	/api/auth/login	none	Login; returns platform JWT
POST	/api/auth/password-reset/request	none	Body { "email" } → { sent: true } (always; does not reveal whether the email exists)
POST	/api/auth/password-reset/complete	none	Body { "token", "password" } → { reset: true }
GET	/api/auth/me	platform JWT or PAT	Current platform user
GET	/api/auth/oauth/providers	none	Enabled SSO providers
GET	/api/auth/oauth/:provider/start	none	Start Google / Microsoft / Apple
GET/POST	/api/auth/oauth/:provider/callback	none	IdP callback (Apple may POST)
POST	/api/auth/oauth/exchange	none	Exchange one-time SSO ticket for JWT
GET/POST	/api/auth/ssh-keys	platform	List / add SSH keys
DELETE	/api/auth/ssh-keys/:keyId	platform	Delete SSH key
GET/POST	/api/auth/api-keys	platform	List / create PATs (kfx_…). Creating a PAT needs a session JWT, and the body is on Tokens.
DELETE	/api/auth/api-keys/:keyId	platform	Revoke PAT

Organizations (platform JWT or PAT):

Method	Path	Description
GET/POST	/api/organizations	List / create
GET/PUT/DELETE	/api/organizations/:orgId	Get / update / delete
GET/POST	/api/organizations/:orgId/members	Members
PUT/DELETE	/api/organizations/:orgId/members/:memberId	Role / remove
GET	.../members/:memberId/effective-permissions	Resolved permissions
GET	.../members/:memberId/access	Per-project roles, with source
GET	.../me/permissions	Caller’s permissions
POST	.../transfer-ownership	Hand ownership to another member
GET/POST	.../teams	Teams
GET/POST	.../roles	Roles
GET/POST	.../access-bindings	Role bindings
GET	.../projects/:projectId/access	Who can reach a project

LLM credentials also live under org and project paths (llm-credentials, llm-settings, llm-models, llm-resolved).

Projects: GET/POST /api/projects, GET/PUT/DELETE /api/projects/:id.