diff --git a/server/api/auth/forgot-password.post.ts b/server/api/auth/forgot-password.post.ts
new file mode 100644
index 0000000..9d6326a
--- /dev/null
+++ b/server/api/auth/forgot-password.post.ts
@@ -0,0 +1,7 @@
+import { readBody } from "h3";
+import { forgotPassword } from "../../services/auth";
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody<{ email?: string }>(event);
+  return forgotPassword(event, body.email ?? "");
+});
diff --git a/server/api/auth/login.post.ts b/server/api/auth/login.post.ts
new file mode 100644
index 0000000..d94e303
--- /dev/null
+++ b/server/api/auth/login.post.ts
@@ -0,0 +1,10 @@
+import { readBody } from "h3";
+import { loginWithSession } from "../../services/auth";
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody<{ email?: string; password?: string }>(event);
+  return loginWithSession(event, {
+    email: body.email ?? "",
+    password: body.password ?? "",
+  });
+});
diff --git a/server/api/auth/logout.post.ts b/server/api/auth/logout.post.ts
new file mode 100644
index 0000000..cfe6145
--- /dev/null
+++ b/server/api/auth/logout.post.ts
@@ -0,0 +1,3 @@
+import { logoutSession } from "../../services/auth";
+
+export default defineEventHandler((event) => logoutSession(event));
diff --git a/server/api/auth/register.post.ts b/server/api/auth/register.post.ts
new file mode 100644
index 0000000..c2e8f19
--- /dev/null
+++ b/server/api/auth/register.post.ts
@@ -0,0 +1,3 @@
+import { registerWithSession } from "../../services/auth";
+
+export default defineEventHandler((event) => registerWithSession(event));
diff --git a/server/api/auth/reset-password.post.ts b/server/api/auth/reset-password.post.ts
new file mode 100644
index 0000000..e24dfd1
--- /dev/null
+++ b/server/api/auth/reset-password.post.ts
@@ -0,0 +1,13 @@
+import { readBody } from "h3";
+import { resetPassword } from "../../services/auth";
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody<{
+    token?: string;
+    new_password?: string;
+  }>(event);
+  return resetPassword(event, {
+    token: body.token ?? "",
+    new_password: body.new_password ?? "",
+  });
+});
diff --git a/server/api/auth/verify-email.post.ts b/server/api/auth/verify-email.post.ts
new file mode 100644
index 0000000..2c85b97
--- /dev/null
+++ b/server/api/auth/verify-email.post.ts
@@ -0,0 +1,7 @@
+import { readBody } from "h3";
+import { verifyEmail } from "../../services/auth";
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody<{ token?: string }>(event);
+  return verifyEmail(event, body.token ?? "");
+});
diff --git a/server/api/hello.ts b/server/api/hello.ts
deleted file mode 100644
index 253114b..0000000
--- a/server/api/hello.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import { usersTable } from "drizzle-pkg/lib/schema/schema";
-import { dbGlobal } from "drizzle-pkg/lib/db";
-import log4js from "logger";
-
-const logger = log4js.getLogger("APP")
-
-export default defineEventHandler(async (event) => {
-    logger.info("hello: world");
-    const users = await dbGlobal.select().from(usersTable)
-    logger.info("users (formatted): %s \n", JSON.stringify(users, null, 2));
-    return {
-        hello: 'world',
-        users: users,
-    }
-})
\ No newline at end of file
diff --git a/server/api/me.get.ts b/server/api/me.get.ts
new file mode 100644
index 0000000..2f9f7c6
--- /dev/null
+++ b/server/api/me.get.ts
@@ -0,0 +1,3 @@
+import { getCurrentUser } from "../services/auth";
+
+export default defineEventHandler((event) => getCurrentUser(event));
diff --git a/server/api/me.patch.ts b/server/api/me.patch.ts
new file mode 100644
index 0000000..d032e31
--- /dev/null
+++ b/server/api/me.patch.ts
@@ -0,0 +1,7 @@
+import { readBody } from "h3";
+import { patchMe } from "../services/auth";
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody<{ name?: string; age?: number }>(event);
+  return patchMe(event, body ?? {});
+});
diff --git a/server/plugins/05.api-error-json.ts b/server/plugins/05.api-error-json.ts
new file mode 100644
index 0000000..d1c71a1
--- /dev/null
+++ b/server/plugins/05.api-error-json.ts
@@ -0,0 +1,17 @@
+import { send, setResponseStatus } from "h3";
+
+/**
+ * 将 API 路由上 `createError({ data: { error } })` 的 body 以 JSON 返回（与规格一致）。
+ */
+export default defineNitroPlugin((nitroApp) => {
+  nitroApp.hooks.hook("error", async (error, ctx) => {
+    const event = ctx.event;
+    if (!event?.path?.startsWith("/api/")) return;
+    const err = error as { statusCode?: number; data?: unknown };
+    const data = err.data as { error?: { code: string; message: string } } | undefined;
+    if (!data?.error) return;
+    if (event.node.res.headersSent) return;
+    setResponseStatus(event, err.statusCode ?? 500);
+    await send(event, JSON.stringify(data), "application/json");
+  });
+});