API authentication
Login, cookies, refresh, rate limits.
REST base path is /api. Login via POST /auth/login to receive httpOnly session cookies.
Call GET /auth/me for the current user; POST /auth/refresh to rotate access tokens.
Respect rate limits on login, register, checkout, and payment webhooks.
Full tables live in the markdown API Reference under docs/api/reference.md.