Register User

POST

auth

curl --request POST \
  --url https://auth.nullpass.xyz/api/auth/register \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "jsmith@example.com",
  "password": "<string>",
  "username": "<string>"
}
'

import requests

url = "https://auth.nullpass.xyz/api/auth/register"

payload = {
    "email": "jsmith@example.com",
    "password": "<string>",
    "username": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({email: 'jsmith@example.com', password: '<string>', username: '<string>'})
};

fetch('https://auth.nullpass.xyz/api/auth/register', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://auth.nullpass.xyz/api/auth/register",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'email' => 'jsmith@example.com',
    'password' => '<string>',
    'username' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://auth.nullpass.xyz/api/auth/register"

	payload := strings.NewReader("{\n  \"email\": \"jsmith@example.com\",\n  \"password\": \"<string>\",\n  \"username\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://auth.nullpass.xyz/api/auth/register")
  .header("Content-Type", "application/json")
  .body("{\n  \"email\": \"jsmith@example.com\",\n  \"password\": \"<string>\",\n  \"username\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://auth.nullpass.xyz/api/auth/register")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"email\": \"jsmith@example.com\",\n  \"password\": \"<string>\",\n  \"username\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "user": {
    "id": "<string>",
    "email": "jsmith@example.com",
    "username": "<string>",
    "displayName": "<string>",
    "avatar": "<string>",
    "twoFactorEnabled": true,
    "createdAt": "2023-11-07T05:31:56Z"
  },
  "token": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}

Endpoint

POST /api/auth/register

Overview

Creates a new user account, generates a JWT token, creates an initial session, and logs audit events. The endpoint is protected by Arcjet with rate limiting (2 requests per token bucket).

Request

string

required

User email address. Must be unique and valid email format.

string

required

User password. Minimum 8 characters. Will be hashed with bcrypt (10 rounds).

string

Optional display name for the user (1-100 characters).

Response

object

Created user object

Show User Object

string

Unique user ID (CUID)

string

User email address

string

User display name (if provided)

string

ISO timestamp of account creation

string

JWT token for authentication. Valid for 7 days (configurable via JWT_EXPIRES_IN).

Implementation Details

Process Flow

CORS Check: Validates CORS headers
Arcjet Protection: Rate limiting (2 requests per bucket)
Email Validation: Arcjet email validation
Duplicate Check: Verifies email doesn’t exist
Password Hashing: bcrypt with 10 rounds
User Creation: Creates user in database
IP Encryption: Encrypts IP address using user-specific key
Session Creation: Creates session with JWT token
Audit Logging: Logs USER_REGISTER and SESSION_CREATE events

Code Reference

export async function POST(request: NextRequest) {
  const corsResponse = handleCors(request)
  if (corsResponse) return corsResponse

  const blocked = await protectRoute(request, { requested: 2 })
  if (blocked) return blocked

  try {
    const body = await request.json()
    const validated = registerSchema.parse(body)

    logger.ups('Register attempt:', validated.email)

    const emailValidation = await validateEmailWithArcjet(request, validated.email)
    if (emailValidation) return emailValidation

    const existingUser = await prisma.user.findUnique({
      where: { email: validated.email },
    })

    if (existingUser) {
      logger.warn('Register failed: User already exists', validated.email)
      return errorResponse('User already exists', 409, request.headers.get('origin'))
    }

    const passwordHash = await bcrypt.hash(validated.password, 10)

    const user = await prisma.user.create({
      data: {
        email: validated.email,
        passwordHash,
        displayName: validated.displayName,
      },
      select: {
        id: true,
        email: true,
        displayName: true,
        createdAt: true,
      },
    })

    const clientIp = getClientIp(request)
    const encryptedIp = getClientIpForStorage(request, user.id)

    const token = generateToken({ userId: user.id, email: user.email })
    const expiresAt = getSessionExpiresAt()

    await prisma.session.create({
      data: {
        userId: user.id,
        token,
        expiresAt,
        ip: encryptedIp,
      },
    })

    await createAuditLog(user.id, 'USER_REGISTER', {
      email: user.email,
      ip: encryptedIp,
    })
    await createAuditLog(user.id, 'SESSION_CREATE', {
      ip: encryptedIp,
    })

    return jsonResponse(
      {
        user,
        token,
      },
      201,
      request.headers.get('origin')
    )
  } catch (error: any) {
    if (error.name === 'ZodError') {
      logger.warn('Register validation error:', error.errors)
      return errorResponse(error.errors[0].message, 400, request.headers.get('origin'))
    }
    logger.error('Register error:', error)
    return errorResponse('Internal server error', 500, request.headers.get('origin'))
  }
}

Status Codes

Created

User successfully created

Bad Request

Validation error (invalid email format, password too short, etc.)

Conflict

User with this email already exists

Forbidden

Blocked by Arcjet (rate limit exceeded, bot detected, etc.)

Internal Server Error

Server error during user creation

Example Request

curl -X POST https://auth.nullpass.xyz/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "securepassword123",
    "displayName": "John Doe"
  }'

Example Response

{
  "user": {
    "id": "clx1234567890abcdef",
    "email": "user@example.com",
    "displayName": "John Doe",
    "createdAt": "2024-01-01T00:00:00.000Z"
  },
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Audit Events

This endpoint creates the following audit log entries:

USER_REGISTER: User account created
SESSION_CREATE: Initial session created

Security Considerations

Password is hashed with bcrypt (10 rounds) before storage
IP address is encrypted using user-specific encryption key
Email validation performed via Arcjet
Rate limiting prevents abuse (2 requests per bucket)
All actions are logged in audit trail

Body

application/json

string<email>

required

password

string

required

Minimum string length: 8

username

string

Response

User created successfully

user

object

Show child attributes

token

string

LoginAuthenticate user and create session

curl --request POST \
  --url https://auth.nullpass.xyz/api/auth/register \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "jsmith@example.com",
  "password": "<string>",
  "username": "<string>"
}
'

import requests

url = "https://auth.nullpass.xyz/api/auth/register"

payload = {
    "email": "jsmith@example.com",
    "password": "<string>",
    "username": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({email: 'jsmith@example.com', password: '<string>', username: '<string>'})
};

fetch('https://auth.nullpass.xyz/api/auth/register', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://auth.nullpass.xyz/api/auth/register",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'email' => 'jsmith@example.com',
    'password' => '<string>',
    'username' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://auth.nullpass.xyz/api/auth/register"

	payload := strings.NewReader("{\n  \"email\": \"jsmith@example.com\",\n  \"password\": \"<string>\",\n  \"username\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://auth.nullpass.xyz/api/auth/register")
  .header("Content-Type", "application/json")
  .body("{\n  \"email\": \"jsmith@example.com\",\n  \"password\": \"<string>\",\n  \"username\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://auth.nullpass.xyz/api/auth/register")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"email\": \"jsmith@example.com\",\n  \"password\": \"<string>\",\n  \"username\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "user": {
    "id": "<string>",
    "email": "jsmith@example.com",
    "username": "<string>",
    "displayName": "<string>",
    "avatar": "<string>",
    "twoFactorEnabled": true,
    "createdAt": "2023-11-07T05:31:56Z"
  },
  "token": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}

Get Started

Authentication

Services

Webhooks

Account Management

Service Connection

Polar Integration

Admin

Advanced

Library

Endpoint

Overview

Request

Response

Implementation Details

Process Flow

Code Reference

Status Codes

Example Request

Example Response

Audit Events

Security Considerations

Body

Response

​Endpoint

​Overview

​Request

​Response

​Implementation Details

​Process Flow

​Code Reference

​Status Codes

​Example Request

​Example Response

​Audit Events

​Security Considerations

Body

Response

Endpoint

Overview

Request

Response

Implementation Details

Process Flow

Code Reference

Status Codes

Example Request

Example Response

Audit Events

Security Considerations