Alphabet quickstart: run the API and get authenticated

Learn how to run the Alphabet API, create your first account, authenticate, and make your first authorized API call in under 5 minutes.

This guide walks you through cloning the repository, starting the API, registering a user account, and making your first authenticated request. By the end you will have a running Alphabet instance and a valid access token you can use to explore any protected endpoint.

Prerequisites

• .NET 10 SDK
• Docker (optional — needed only for SQL Server and Redis)
• A REST client: curl, Postman, or HTTPie

1. Clone and restore

   Clone the repository and restore NuGet packages:

   git clone https://github.com/itsarisid/slate.git
   cd slate
   dotnet restore Alphabet.slnx
   
2. Start dependencies (optional)

   If you want to use SQL Server and Redis instead of the in-memory providers, start them with Docker Compose:

   docker compose up -d
   

   You can skip this step if you switch Database.Provider to InMemory and Cache.Provider to Memory in appsettings.json. See Configuration for details.

3. Run the API

   Start the API from the solution root:

   dotnet run --project src/Gateway/Alphabet.AppWire/Alphabet.AppWire.csproj
   

   The API listens on https://localhost:5001. You will see Serilog request logs in the terminal as traffic arrives.

4. Explore Swagger

   Open https://localhost:5001/swagger in your browser. Every endpoint is documented with summaries and example payloads, and you can execute requests directly from the UI.

   Swagger is enabled only in the development environment. It is not exposed in production builds.

5. Register an account

   Send a POST request to create your first user:

   curl -X POST https://localhost:5001/api/v1/auth/register \
     -H "Content-Type: application/json" \
     -d '{
       "email": "[e-mail]",
       "password": "YourPassword123!",
       "firstName": "Jane",
       "lastName": "Doe"
     }'
   

   A successful registration returns 200 OK. The API sends a confirmation email to the address you provided.

6. Confirm your email

   Check your inbox for the confirmation link and click it to activate your account.

   During local development you can use the seeded admin account instead of waiting for email delivery:

   • Email: [e-mail]
   • Password: Admin12345!

   This account is seeded automatically on startup and has full administrative privileges.

7. Login and get your access token

   Exchange your credentials for a JWT access token:

   curl -X POST https://localhost:5001/api/v1/auth/login \
     -H "Content-Type: application/json" \
     -d '{
       "email": "[e-mail]",
       "password": "YourPassword123!"
     }'
   

   The response contains your tokens:

   {
     "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
     "refreshToken": "dGhpcyBpcyBhIHNhbXBsZSByZWZyZXNoIHRva2Vu..."
   }
   

   Store the accessToken — you need it for every protected request. Use the refreshToken to obtain a new access token when the current one expires (access tokens expire after 15 minutes by default).

8. Make an authenticated request

   Pass the access token in the Authorization header to call any protected endpoint:

   curl https://localhost:5001/api/v1/auth/me \
     -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
   

   The /api/v1/auth/me endpoint returns the profile of the currently authenticated user. A 401 Unauthorized response means your token is missing, expired, or malformed.

Next steps

• Read the Authentication overview to understand token refresh, MFA, and cookie-based auth.
• Explore Access Control to learn how privileges and roles protect your endpoints.
• Check the Configuration guide to switch database providers, connect Redis, and update CORS origins.