bcryptjs (cost 10) before insertion.
Request
Body
Responses
201 Created
hashed_password column is never returned.
400 Bad Request - invalid JSON
400 Bad Request - validation failure
409 Conflict - duplicate
When the email or username already exists. Two possible bodies depending on which check tripped:INSERT - the route translates Postgres unique_violation (23505) to 409 rather than leaking 500.
cURL
After registering
You’re not logged in yet. Use the NextAuth credentials sign-in flow (the/login page in the app), or POST /api/auth/callback/credentials directly. See the NextAuth REST API docs.