> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/Braian551/viax/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the Viax API

## Overview

The Viax API uses session-based authentication. After successful login, the API returns user information that should be stored and included in subsequent requests where required.

<Note>
  Currently, the API does not use JWT tokens or API keys. Authentication is managed through session data on the client side. Future versions may implement token-based authentication.
</Note>

## Authentication Flow

<Steps>
  <Step title="Register or Login">
    Create an account using `/auth/register.php` or login with `/auth/login.php`
  </Step>

  <Step title="Store User Data">
    Save the returned user object, including the `id` and `uuid` fields
  </Step>

  <Step title="Include User ID">
    Send the `userId` or `conductor_id` in requests that require authentication
  </Step>
</Steps>

## Login Request

To authenticate a user:

```bash theme={null}
curl -X POST https://76.13.114.194/auth/login.php \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "yourPassword123"
  }'
```

## Login Response

Successful authentication returns:

```json theme={null}
{
  "success": true,
  "message": "Login exitoso",
  "user": {
    "id": 123,
    "uuid": "550e8400-e29b-41d4-a716-446655440000",
    "nombre": "Juan",
    "apellido": "Pérez",
    "email": "user@example.com",
    "telefono": "+573001234567",
    "tipo_usuario": "pasajero",
    "creado_en": "2024-01-15T10:30:00.000Z",
    "calificacion": 4.8,
    "location": {
      "id": 1,
      "usuario_id": 123,
      "direccion": "Calle 100 #15-20",
      "ciudad": "Bogotá",
      "departamento": "Cundinamarca",
      "pais": "Colombia",
      "latitud": 4.7110,
      "longitud": -74.0721,
      "es_principal": true
    }
  },
  "token": null,
  "token_expires_at": null
}
```

## User Types

The API supports different user types specified in the `tipo_usuario` field:

<ParamField path="tipo_usuario" type="string">
  User role in the system

  **Possible values:**

  * `pasajero` - Regular passenger user
  * `conductor` - Driver user
  * `admin` - Administrative user
  * `empresa` - Company/fleet user
</ParamField>

## Authenticated Requests

Include the user ID in requests that require authentication:

### As Query Parameter

```bash theme={null}
curl -X GET "https://76.13.114.194/auth/profile.php?userId=123" \
  -H "Accept: application/json"
```

### In Request Body

```bash theme={null}
curl -X POST https://76.13.114.194/viajes/create_trip.php \
  -H "Content-Type: application/json" \
  -d '{
    "usuario_id": 123,
    "tipo_servicio": "motocicleta",
    "origen": {...},
    "destino": {...}
  }'
```

## Checking Authentication Status

Verify if a user account exists:

```bash theme={null}
curl -X POST https://76.13.114.194/auth/check_user.php \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com"}'
```

Response:

```json theme={null}
{
  "exists": true
}
```

## Session Management

<Warning>
  The client application is responsible for managing user sessions. Store user data securely using:

  * Secure local storage
  * Encrypted shared preferences (mobile)
  * HTTP-only cookies (web)
</Warning>

### Session Data Structure

Store the following data from the login response:

```dart theme={null}
class AuthSession {
  final User user;              // Complete user object
  final String? token;          // Currently null, reserved for future use
  final DateTime? tokenExpiresAt;
  final DateTime loginAt;       // Timestamp of login
}
```

## Logout

<Note>
  Currently, logout is handled client-side by clearing stored session data. No server-side logout endpoint is required.
</Note>

To logout:

1. Clear stored user data from local storage
2. Clear any cached information
3. Redirect to login screen

## Password Requirements

<Warning>
  Implement strong password requirements in your client application:

  * Minimum 8 characters
  * Mix of uppercase and lowercase
  * Include numbers
  * Include special characters
</Warning>

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Use HTTPS" icon="lock">
    Always use HTTPS in production to encrypt data in transit
  </Card>

  <Card title="Store Securely" icon="shield">
    Never store passwords. Only store user IDs and non-sensitive data
  </Card>

  <Card title="Validate Input" icon="check">
    Validate all user input before sending to API
  </Card>

  <Card title="Handle Errors" icon="triangle-exclamation">
    Properly handle authentication errors and timeouts
  </Card>
</CardGroup>

## Common Authentication Errors

| Status Code | Error        | Description                         |
| ----------- | ------------ | ----------------------------------- |
| 401         | Unauthorized | Invalid credentials                 |
| 403         | Forbidden    | User account is inactive or blocked |
| 404         | Not Found    | User does not exist                 |
| 500         | Server Error | Internal server error               |

See [Error Handling](/api/error-handling) for more details.