docs

docs/api/README.md

@@ -0,0 +1,41 @@
+# Dash API
+
+```
+http://localhost:4208/api
+```
+
+## CORS & cookies
+
+All browser requests that need auth must send cookies:
+
+```js
+fetch('http://localhost:4208/api/auth/me', {
+  credentials: 'include',
+});
+```
+
+Sessions use an HTTP-only `token` cookie (`Secure`, `SameSite=Strict`, 24h). The browser must talk to the API over **HTTPS** for login to work — `Secure` cookies are not sent on plain HTTP.
+
+## Auth flow
+
+1. Call [`GET /auth/me`](routes/auth/me.md) to get `googleClientId` (included in 200 and 401 responses).
+2. Sign in with Google on the frontend (Google Identity Services / One Tap).
+3. POST the Google ID token to [`POST /auth/login`](routes/auth/login.md).
+4. The API sets the session cookie.
+5. Call protected routes with `credentials: 'include'`. The cookie is refreshed automatically when it has less than 2 hours left.
+
+## Routes
+
+Mirrors [`src/api/routes/`](../../src/api/routes/).
+
+| File | Endpoint |
+|------|----------|
+| [`routes/auth/login.md`](routes/auth/login.md) | `POST /auth/login` |
+| [`routes/auth/logout.md`](routes/auth/logout.md) | `POST /auth/logout` |
+| [`routes/auth/me.md`](routes/auth/me.md) | `GET /auth/me` |
+| [`routes/health.md`](routes/health.md) | `GET /health` |
+
+## Frontend checklist
+
+- [ ] `credentials: 'include'` on every API call
+- [ ] HTTPS in dev (or proxy) so `Secure` cookies work