Generated Endpoint Reference
WordPress Auth routes, request inputs, and response outcomes.
Generated Auth endpoints
The theme generates these under /wp-json/forgewp/v1/auth. Use the hooks for normal React account interfaces. This reference describes the WordPress endpoints, not the separate optional JWT plugin endpoints.
Method Path Main JSON input or result POST /login credential (or username/email/user), password (or user_password); returns user on success POST /signup Same callback as /register POST /register username, email, password, optional displayName and approved metadata POST /logout Ends the WordPress session; success boolean GET /me user payload or null for the resolved current WordPress user GET /config loginField and emailVerificationEnabled POST /verify-email userId and token; validates token and establishes a session POST /resend-verification email (username also accepted), or username; attempts verification mail POST /lost-password user_login, or email/username; delegates recovery to WordPress POST /reset-password login (or username/user_login), key, password; validates key before changing password |
|---|
Use a WordPress base path before /wp-json for subdirectory installs. JSON body requests use Content-Type: application/json. Browser cookie/nonces and cross-origin behavior must be tested against the installed deployment; the route table does not establish a working remote session.
Response handling
WordPress errors are non-success responses with an error code and message. Hooks expose the message through error and return false for failed boolean actions. A 502 resend failure means mail transport rejected the send; it is retryable without creating another account.
Successful signup can return either a user or an account-created response. Without a user, inspect success, requiresVerification, message, and, where present, verificationEmailSent. A failed automatic sign-in keeps account creation successful. Hooks expose account-created messages through notice and do not return the raw response object.
Route registration is not the whole security policy
These account-entry routes use public permission callbacks; their handlers validate credentials, keys, registration policy, or the current session as appropriate. This does not supply a generic nonce-refresh, rate-limit, CAPTCHA, or arbitrary endpoint-authorization service. Validate the complete deployment before treating account workflows as production-accepted.
The public /config response exposes only login/verification UI policy. The local development runtime can project additional public signup defaults; private email content is not included in that preview policy.