Public and JWT-authenticated REST API built with Hono, deployed on Cloudflare Workers with D1 storage.
Each table (users, products, transactions) is capped at 100 rows.
Before every insert, the oldest rows are deleted automatically so the table never exceeds 100.
Base URL
All paths are relative to the deployed worker URL.
Authentication
Passwords are hashed with SHA-256 (Web Crypto). Auth endpoints issue a JWT (HS256, 24h expiry). Authenticated routes require an Authorization: Bearer <token> header.
Method
Path
Description
POST
/auth/register
Register a new user and return a JWT
POST
/auth/login
Log in and return a JWT
Public API
Rate limited to 60 requests per minute per IP. No auth required.
Users
Method
Path
Description
GET
/api/v1/users
List users
GET
/api/v1/users/:id
Get a user by ID
POST
/api/v1/users
Create a user
PUT
/api/v1/users/:id
Update a user
DELETE
/api/v1/users/:id
Delete a user
Products
Method
Path
Description
GET
/api/v1/products
List products
GET
/api/v1/products/:id
Get a product by ID
POST
/api/v1/products
Create a product
PUT
/api/v1/products/:id
Update a product
DELETE
/api/v1/products/:id
Delete a product
Transactions
Method
Path
Description
GET
/api/v1/transactions
List transactions
GET
/api/v1/transactions/:id
Get a transaction by ID
POST
/api/v1/transactions
Create a transaction
PUT
/api/v1/transactions/:id
Update a transaction
DELETE
/api/v1/transactions/:id
Delete a transaction
Authenticated API
Requires a valid JWT. Reuses the same CRUD handlers as the public routes.
Users
Method
Path
Description
GET
/auth/users
List users
GET
/auth/users/:id
Get a user by ID
POST
/auth/users
Create a user
PUT
/auth/users/:id
Update a user
DELETE
/auth/users/:id
Delete a user
Products
Method
Path
Description
GET
/auth/products
List products
GET
/auth/products/:id
Get a product by ID
POST
/auth/products
Create a product
PUT
/auth/products/:id
Update a product
DELETE
/auth/products/:id
Delete a product
Data models
User
Field
Type
Notes
id
string (UUID)
Primary key
email
string
Unique
name
string
password_hash
string
SHA-256 hash, never exposed
role
'user' | 'admin'
Default 'user'
created_at
integer
Unix epoch milliseconds
Product
Field
Type
Notes
id
string (UUID)
Primary key
name
string
description
string
Default ''
price
number
Positive
stock
integer
Non-negative
created_at
integer
Unix epoch milliseconds
Transaction
Field
Type
Notes
id
string (UUID)
Primary key
user_id
string (UUID)
product_id
string (UUID)
quantity
integer
Positive
total
number
price * quantity
status
'pending' | 'completed' | 'cancelled'
Default 'pending'
created_at
integer
Unix epoch milliseconds
Rate limiting
All /api/v1/* routes use a D1-backed counter. Each IP (CF-Connecting-IP) is limited to 60 requests per minute. Limited responses include a Retry-After header.