Tarkibga o'tish

Autentifikatsiya API

Barcha auth endpointlari /api/v1/auth/ prefiksi bilan boshlanadi.

Asosiy tushunchalar

JWT Token

Muvaffaqiyatli kirishdan keyin token qaytariladi. Himoyalangan endpointlarga so'rov yuborishda:

Authorization: Bearer <token>

Token muddati standart 7 kun. Muddati tugashidan oldin yangilash kerak.

Two-step oqim

Agar foydalanuvchi 2FA yoqilgan bo'lsa, login two_step_required: true qaytaradi. Keyingi qadam POST /api/v1/auth/two-step.

Ro'yxatdan o'tish

POST /api/v1/auth/signup
Content-Type: application/json

So'rov: 

{
  "first_name": "Ali",
  "last_name": "Valiyev",
  "email": "ali@example.com",
  "password": "kamida8belgi",
  "language": "uz"
}

Javob (201): 

{
  "ok": true,
  "message": "Email tasdiqlash kodi yuborildi"
}

Ro'yxatdan o'tgandan keyin email tasdiqlash talab qilinadi (OTP kodi). Tasdiqlanmagan hisob cheklangan imkoniyatlarda ishlaydi.

Email tasdiqlash

POST /api/v1/auth/verify
Content-Type: application/json

{
  "email": "ali@example.com",
  "code": "123456"
}

Javob (200): 

{
  "ok": true,
  "token": "eyJ...",
  "user": {
    "id": 42,
    "username": "ali1234",
    "email": "ali@example.com",
    "first_name": "Ali",
    "last_name": "Valiyev",
    "is_verified": true
  }
}

OTP ni qayta yuborish

POST /api/v1/auth/resend-otp
Content-Type: application/json

{ "email": "ali@example.com" }

Limit: 3 marta/daqiqa.

Kirish (Login)

POST /api/v1/auth/login
Content-Type: application/json

{
  "email": "ali@example.com",
  "password": "parol123"
}

Javob — oddiy kirish (200): 

{
  "ok": true,
  "token": "eyJ...",
  "user": { "id": 42, "username": "ali1234", ... }
}

Javob — 2FA talab qilinsa (200): 

{
  "ok": true,
  "two_step_required": true,
  "two_step_token": "eyJ...",
  "hint": "ikkinchi parolning birinchi 3 harfi: ali"
}

Rate limiting

Kirish: 5 marta/daqiqa. Ortiqcha urinishda 429 Too Many Requests.

Ikki bosqichli tasdiqlash

POST /api/v1/auth/two-step
Content-Type: application/json
Authorization: Bearer <two_step_token>

{ "password": "ikkinchiParol" }

Javob (200): 

{
  "ok": true,
  "token": "eyJ...",
  "user": { ... }
}

Ishonchli qurilma (eslab qolish)

So'rovga "remember": true qo'shilsa, ushbu qurilma 30 kun davomida ishonchli hisoblanib, keyingi kirishlarda 2FA so'ralmasligi mumkin.

{ "password": "ikkinchiParol", "remember": true }

2FA — qayta yuborish

POST /api/v1/auth/resend-two-step
Authorization: Bearer <two_step_token>

2FA — tiklash kodlari

Emailga kirish imkoni bo'lmaganda tiklash kodi bilan kirish:

POST /api/v1/auth/two-step/forgot
Authorization: Bearer <two_step_token>
Content-Type: application/json

{ "recovery_code": "ABCD-1234" }

Parolni tiklash

1-qadam — OTP so'rash

POST /api/v1/auth/forgot-password
Content-Type: application/json

{ "email": "ali@example.com" }

2-qadam — yangi parol o'rnatish

POST /api/v1/auth/verify-reset
Content-Type: application/json

{
  "email": "ali@example.com",
  "code": "123456",
  "new_password": "yangiParol123"
}

Token yangilash

POST /api/v1/auth/refresh
Authorization: Bearer <eski_token>

Javob (200): 

{
  "ok": true,
  "token": "eyJ..."
}

Chiqish (Logout)

POST /api/v1/auth/logout
Authorization: Bearer <token>

Joriy sessiya tokenini bekor qiladi.

Joriy foydalanuvchi

GET /api/v1/auth/me
Authorization: Bearer <token>

Javob (200): 

{
  "ok": true,
  "user": {
    "id": 42,
    "username": "ali1234",
    "email": "ali@example.com",
    "first_name": "Ali",
    "last_name": "Valiyev",
    "bio": null,
    "avatar_url": null,
    "is_verified": true,
    "is_admin": false,
    "created_at": "2026-01-15T10:00:00Z"
  }
}

Action token (Muhim amallar uchun)

Parol o'zgartirish, 2FA o'chirish kabi muhim amallarda qo'shimcha tasdiqlash talab qilinadi.

1-qadam — challenge so'rash

POST /api/v1/auth/action-challenge
Authorization: Bearer <token>
Content-Type: application/json

{ "action": "change_password" }

Javob: 

{
  "ok": true,
  "challenge_token": "eyJ..."
}

2-qadam — OTP tasdiqlash

POST /api/v1/auth/action-verify
Authorization: Bearer <token>
Content-Type: application/json

{
  "challenge_token": "eyJ...",
  "code": "123456"
}

Javob: 

{
  "ok": true,
  "action_token": "eyJ..."
}

action_token keyin muhim amalni bajarishda X-Action-Token sarlavhasida yuboriladi.

Xato kodlari

Kod Sabab
email_taken Bu email allaqachon ro'yxatdan o'tgan
invalid_credentials Email yoki parol noto'g'ri
account_locked Juda ko'p noto'g'ri urinish — biroz kuting
account_blocked Hisob bloklangan
email_not_verified Email tasdiqlanmagan
invalid_otp OTP kodi noto'g'ri yoki muddati o'tgan
invalid_two_step 2FA paroli noto'g'ri
token_expired JWT token muddati tugagan
token_revoked Token bekor qilingan (logout yoki qurilma o'chirilgan)