Google OAuth authentication
Authenticates user using a Google OAuth2 authorization code from the popup auth-code flow
application/json- body
code*stringGoogle OAuth2 authorization code from the popup auth-code flow
Authentication successful
application/json- response
accessToken*stringJWT access token for authentication
user*Authenticated user
curl -X POST 'https://api.routess.com/auth/google' \ -H 'Content-Type: application/json' \ -d '{ "code": "4/0AX4XfWj..."}'{ "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "user": { "id": 1, "email": "[email protected]", "name": "Jane Doe", "handle": "jane-doe", "avatar": "https://example.com/avatar.jpg", "isEmailVerified": true, "role": "user", "preferences": { "units": "km", "showPois": true, "terrain3d": false, "autoSnap": true, "defaultActivity": "Cycling", "selectedSports": [ "cycle", "run" ], "sportSpeeds": { "run": 10, "cycle": 25, "walk": 5 }, "mapStyle": "outdoors", "overlays": { "heatmap": true, "contour": false, "bike": true, "surface": false, "wind": false, "hikingNodes": false, "cyclingNodes": false }, "defaultRouteVisibility": "private", "routingDefaults": { "cycle": { "surfacePreference": "mixed", "avoidFerries": true, "avoidHighways": true }, "run": { "surfacePreference": "mixed", "avoidFerries": true, "avoidHighways": true }, "walk": { "surfacePreference": "mixed", "avoidFerries": true, "avoidHighways": true } } }, "idHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", "deletionStatus": "active", "deletionRequestedAt": "2026-05-09T08:00:00.000Z", "hasPassword": true }}Cancel a pending account deletion
Cancels a self-initiated deletion that's still inside the 30-day grace window. Restores the user's routes and clears the pending status. No-op if the user is not in a pending state.
Email + password signup (request)
Step 1 of email+password signup. Validates the password (length 12-128, HIBP breach check) and emails a verification link. The User row is NOT created until the verification link is clicked. Always returns 200 regardless of whether the email is already registered (no enumeration); existing accounts get a 'you already have an account' email instead of a verification link.