---
type: API Endpoint
title: Auth routes
description: POST /api/auth/google, POST /api/auth/logout, GET /api/auth/me.
resource: backend/src/routes/auth.ts
tags: [api, auth]
timestamp: 2026-08-12T00:00:00Z
---

# Auth routes

Mounted at `/api/auth` (`backend/src/index.ts`).

# Examples

```
POST /api/auth/google
Body: { "credential": "<google id token>" }
200 -> { "user": SessionUser }
400 -> missing credential
401 -> invalid Google token
403 -> email not verified, or not an admin and not an active employee
```

Sets the `eatme_session` cookie on success. See
[Auth flow](/docs/architecture/auth-flow.md) for what happens before this
(role resolution) and what's inside the cookie.

```
POST /api/auth/logout
204, clears the session cookie. No auth required.
```

```
GET /api/auth/me
Requires a valid session cookie (requireAuth).
200 -> { "user": SessionUser }
401 -> not authenticated
```

`SessionUser` shape (`backend/src/types.ts`):

```ts
{ email: string; name: string | null; role: "admin" | "employee"; employeeId: number | null }
```

# Related

- [Auth flow](/docs/architecture/auth-flow.md)
- [Attendance routes](./attendance-routes.md)
- [Admin routes](./admin-routes.md)