Auth (Core Backend)

Every v1 Core call needs header x-api-key. JWT is extra, depending on the key's require_user_bearer_token and path settings.

Action	Winner
Register	POST /public/api/v1/nellalink/user/register
Login	POST /public/api/v1/nellalink/user/login
Refresh	POST /public/api/v1/nellalink/user/refresh
Logout	POST /public/api/v1/nellalink/user/logout
Reset password	POST .../user/reset-password + /validate
Change password	POST .../user/change-password + /validate
Verify email	POST .../user/verify-email-address + /validate

Full hosts: Authentication screen.

Create API keys: POST /public/api/v1/nellalink/security/api-key. Use two keys: public browse vs JWT writes. IDOR.

ENVs (package config/nellalink-laravel.php; prefer ENV-SAMPLE when present): NELLALINK_JWT_SECRET, NELLALINK_ACCESS_TOKEN_TTL_MINUTES, NELLALINK_REFRESH_TOKEN_TTL_DAYS, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REDIRECT_URI, APP_URL.