Your first request

No login needed for the health check.

1. Health check

curl http://localhost:3000/health

Expected:

{ "status": "ok" }

If this fails, the server is not running or the port is wrong (PORT in .env, default 3000).

2. What a protected request looks like

Most student APIs need a header:

Authorization: Bearer <access_token>
Content-Type: application/json

Without it, middleware returns 401 with JSON like:

{ "error": "Missing or invalid Authorization header" }

3. API prefix map (from index.ts)

Full URL = prefix + path inside the route file.

Example: if auth.route.ts defines POST /google, the full path is
POST /api/v1/auth/google.

4. Where errors go

• 401 — Not logged in or bad token (auth.middleware.ts)
• 403 — Logged in but not allowed (admin middleware)
• 400 — Bad JSON / failed Zod validation
• 500 — Unhandled exception; index.ts onError returns generic message

Always check the JSON error field in responses during development.