Authentication
Overview
Bronjoy uses Laravel Sanctum for API authentication. All protected endpoints require a Bearer token in the Authorization header.
Authorization: Bearer your-token-here
Every
/api/org/...example in these docs also needs theX-Organization-IDheader described below — it's omitted from individual snippets for brevity.
User Types
Bronjoy has two distinct user types with separate authentication flows:
| Type | Who | Auth Route Prefix |
|---|---|---|
| Staff | Organization owners and staff members | /api/org/auth/... |
| Client | End customers booking appointments | /api/client/auth/... |
Staff Authentication
Register
POST /api/org/auth/register
Content-Type: application/json
{
"name": "Jane Smith",
"email": "[email protected]",
"password": "secret"
}
A verification code is sent to the email. Verify it:
POST /api/org/auth/verify
Content-Type: application/json
{
"email": "[email protected]",
"code": "123456"
}
Response includes the Bearer token:
{
"token": "1|abc123...",
"user": { "id": 1, "name": "Jane Smith", "email": "[email protected]" }
}
Login
POST /api/org/auth/login
Content-Type: application/json
{
"email": "[email protected]",
"password": "secret"
}
Logout
POST /api/auth/logout
Authorization: Bearer your-token-here
This revokes the current token.
Client Authentication
Clients authenticate via phone or email OTP — no passwords.
Phone (OTP)
POST /api/client/auth/phone/request
Content-Type: application/json
{ "phone": "+998901234567" }
POST /api/client/auth/phone/verify
Content-Type: application/json
{
"phone": "+998901234567",
"code": "1234"
}
Email (OTP)
POST /api/client/auth/email/request
Content-Type: application/json
{ "email": "[email protected]" }
POST /api/client/auth/email/verify
Content-Type: application/json
{
"email": "[email protected]",
"code": "123456"
}
Both flows return a token field in the response.
Organization Context
Most /api/org/... endpoints require an organization context, since a staff account can belong to more than one organization. Send the organization ID on every request as a header:
X-Organization-ID: 1
Requests to /api/org/... without this header return 400 Bad Request. Requests to an organization you don't have access to return 403 Forbidden.
Personal API Tokens
You can issue named, scoped API tokens for programmatic access — useful for scripts, integrations, and MCP clients.
Create a token
POST /api/org/ai/tokens
Authorization: Bearer your-staff-token
Content-Type: application/json
{
"name": "My Integration",
"expires_in_days": 90
}
Response:
{
"token": "3|AbCdEf...",
"mcp_endpoint": "https://api.bronjoy.com/api/mcp/organization/1",
"expires_at": "2026-06-23T12:00:00Z",
"instructions": "Use this token in the Authorization header: Bearer <token>"
}
Tokens are shown only once. Store them securely — they cannot be retrieved again.
The generated token is scoped to the specific organization with the mcp:organization:{id} ability and expires after 90 days by default (max 365 days).
Get Current User
GET /api/auth/me
Authorization: Bearer your-token-here
Returns the authenticated user's profile.