# API AUTHENTICATION

[← Request/Response Formats](./02-request-response-formats.md) | [Next: Error Responses →](./04-error-responses.md)

---

## Authentication Flow

1. **Login**: `POST /api/v1/auth/login`
   - Request: `{ email, password }`
   - Response: `{ token, refreshToken, user }`

2. **Protected Routes**: Include `Authorization: Bearer <token>` header

3. **Token Refresh**: `POST /api/v1/auth/refresh-token`
   - Request: `{ refreshToken }`
   - Response: `{ token }`

---

## Authorization

- **RBAC**: Check user roles and permissions
- **Scope-based**: Check project/SPV access
- **Middleware**: `rbac.middleware.ts` validates permissions

Chi tiết: [Authentication & Authorization](../03-backend/03-authentication-authorization.md)

---

**Next**: [Error Responses](./04-error-responses.md)