diff --git a/app/Actions/Auth/ChangePasswordAction.php b/app/Actions/Auth/ChangePasswordAction.php
new file mode 100644
index 0000000..42c2c24
--- /dev/null
+++ b/app/Actions/Auth/ChangePasswordAction.php
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Strava\Actions\Auth;
+
+use Illuminate\Support\Facades\Hash;
+use Strava\Models\User;
+
+class ChangePasswordAction
+{
+    public function execute(User $user, string $currentPassword, string $newPassword): bool
+    {
+        if (!Hash::check($currentPassword, $user->password)) {
+            return false;
+        }
+
+        $hashedPassword = Hash::make($newPassword);
+
+        $user->password = $hashedPassword;
+        $user->save();
+
+        return true;
+    }
+}
diff --git a/app/Actions/Auth/GenerateResetCodeAction.php b/app/Actions/Auth/GenerateResetCodeAction.php
new file mode 100644
index 0000000..035dd16
--- /dev/null
+++ b/app/Actions/Auth/GenerateResetCodeAction.php
@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Strava\Actions\Auth;
+
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Random\RandomException;
+
+class GenerateResetCodeAction
+{
+    public function execute(string $email): string
+    {
+        $code = "";
+
+        try {
+            $code = (string)random_int(100000, 999999);
+        } catch (RandomException $e) {
+            report($e);
+
+            abort(500, "Unable to generate secure reset code.");
+        }
+
+        DB::table("password_reset_tokens")->updateOrInsert(
+            ["email" => $email],
+            [
+                "email" => $email,
+                "token" => Hash::make($code),
+                "created_at" => now(),
+            ],
+        );
+
+        return $code;
+    }
+}
diff --git a/app/Actions/Auth/ResetPasswordAction.php b/app/Actions/Auth/ResetPasswordAction.php
new file mode 100644
index 0000000..e7d333d
--- /dev/null
+++ b/app/Actions/Auth/ResetPasswordAction.php
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Strava\Actions\Auth;
+
+use Illuminate\Auth\Events\PasswordReset;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Password;
+use Illuminate\Support\Str;
+use Strava\Models\User;
+
+class ResetPasswordAction
+{
+    public function execute(array $credentials): bool
+    {
+        $status = Password::reset($credentials, function (User $user, string $password): void {
+            $user->forceFill([
+                "password" => Hash::make($password),
+            ])->setRememberToken(Str::random(60));
+
+            $user->save();
+
+            event(new PasswordReset($user));
+        });
+
+        return $status === Password::PASSWORD_RESET;
+    }
+}
diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php
new file mode 100644
index 0000000..bd02ff9
--- /dev/null
+++ b/app/Http/Controllers/Auth/LoginController.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Strava\Http\Controllers\Auth;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Auth;
+use Strava\Http\Controllers\Controller;
+use Strava\Http\Requests\Auth\LoginRequest;
+use Symfony\Component\HttpFoundation\Response;
+
+class LoginController extends Controller
+{
+    public function login(LoginRequest $request): JsonResponse
+    {
+        $credentials = $request->validated();
+
+        if (!Auth::attempt($credentials)) {
+            return response()->json([], Response::HTTP_FORBIDDEN);
+        }
+
+        $user = Auth::user();
+        $token = $user->createToken("api-token")->plainTextToken;
+
+        return response()->json([
+            "token" => $token,
+            "user_id" => $user->id,
+        ], Response::HTTP_OK);
+    }
+}
diff --git a/app/Http/Controllers/Auth/LogoutController.php b/app/Http/Controllers/Auth/LogoutController.php
new file mode 100644
index 0000000..64690df
--- /dev/null
+++ b/app/Http/Controllers/Auth/LogoutController.php
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Strava\Http\Controllers\Auth;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Strava\Http\Controllers\Controller;
+use Symfony\Component\HttpFoundation\Response;
+
+class LogoutController extends Controller
+{
+    public function logout(Request $request): JsonResponse
+    {
+        $user = $request->user();
+        $token = $user->currentAccessToken();
+
+        if ($token) {
+            $token->delete();
+        }
+
+        return response()->json([], Response::HTTP_OK);
+    }
+}
diff --git a/app/Http/Controllers/Auth/PasswordController.php b/app/Http/Controllers/Auth/PasswordController.php
new file mode 100644
index 0000000..a94a608
--- /dev/null
+++ b/app/Http/Controllers/Auth/PasswordController.php
@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Strava\Http\Controllers\Auth;
+
+use Illuminate\Http\JsonResponse;
+use Strava\Actions\Auth\ChangePasswordAction;
+use Strava\Actions\Auth\GenerateResetCodeAction;
+use Strava\Actions\Auth\ResetPasswordAction;
+use Strava\Http\Controllers\Controller;
+use Strava\Http\Requests\Auth\ChangePasswordRequest;
+use Strava\Http\Requests\Auth\ForgotPasswordRequest;
+use Strava\Http\Requests\Auth\ResetPasswordRequest;
+use Strava\Models\User;
+use Strava\Notifications\ForgotPasswordNotification;
+use Symfony\Component\HttpFoundation\Response;
+
+class PasswordController extends Controller
+{
+    public function sendResetEmail(ForgotPasswordRequest $request, GenerateResetCodeAction $generateResetCodeAction): JsonResponse
+    {
+        $validated = $request->validated();
+        $email = $validated["email"];
+
+        $code = $generateResetCodeAction->execute($email);
+
+        $user = User::query()->where("email", $email)->first();
+        $user?->notify(new ForgotPasswordNotification($code));
+
+        return response()->json([], Response::HTTP_OK);
+    }
+
+    public function resetPassword(ResetPasswordRequest $request, ResetPasswordAction $resetPasswordAction): JsonResponse
+    {
+        $validated = $request->validated();
+        $success = $resetPasswordAction->execute($validated);
+
+        return $success
+            ? response()->json([], Response::HTTP_OK)
+            : response()->json([], Response::HTTP_BAD_REQUEST);
+    }
+
+    public function changePassword(ChangePasswordRequest $request, ChangePasswordAction $changePasswordAction): JsonResponse
+    {
+        $user = $request->user();
+        $validated = $request->validated();
+
+        $currentPassword = $validated["current_password"];
+        $newPassword = $validated["password"];
+
+        $success = $changePasswordAction->execute(
+            $user,
+            $currentPassword,
+            $newPassword,
+        );
+
+        return $success
+            ? response()->json([], Response::HTTP_OK)
+            : response()->json([], Response::HTTP_FORBIDDEN);
+    }
+}
diff --git a/app/Http/Controllers/Auth/RegisterController.php b/app/Http/Controllers/Auth/RegisterController.php
new file mode 100644
index 0000000..89f6c9b
--- /dev/null
+++ b/app/Http/Controllers/Auth/RegisterController.php
@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Strava\Http\Controllers\Auth;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Hash;
+use Strava\Http\Controllers\Controller;
+use Strava\Http\Requests\Auth\RegisterRequest;
+use Strava\Models\User;
+use Symfony\Component\HttpFoundation\Response;
+
+class RegisterController extends Controller
+{
+    public function register(RegisterRequest $request): JsonResponse
+    {
+        $validated = $request->validated();
+
+        $user = new User($validated);
+        $user->password = Hash::make($validated["password"]);
+        $user->save();
+
+        return response()->json([], Response::HTTP_CREATED);
+    }
+}
diff --git a/app/Http/Requests/Auth/ChangePasswordRequest.php b/app/Http/Requests/Auth/ChangePasswordRequest.php
new file mode 100644
index 0000000..99fd31f
--- /dev/null
+++ b/app/Http/Requests/Auth/ChangePasswordRequest.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Strava\Http\Requests\Auth;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class ChangePasswordRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return auth()->check();
+    }
+
+    /**
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            "current_password" => ["required", "string"],
+            "password" => ["required", "string", "min:8", "confirmed"],
+        ];
+    }
+}
diff --git a/app/Http/Requests/Auth/ForgotPasswordRequest.php b/app/Http/Requests/Auth/ForgotPasswordRequest.php
new file mode 100644
index 0000000..a9f9613
--- /dev/null
+++ b/app/Http/Requests/Auth/ForgotPasswordRequest.php
@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Strava\Http\Requests\Auth;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class ForgotPasswordRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            "email" => ["required", "string", "email", "max:255"],
+        ];
+    }
+}
diff --git a/app/Http/Requests/Auth/LoginRequest.php b/app/Http/Requests/Auth/LoginRequest.php
new file mode 100644
index 0000000..2e0eab3
--- /dev/null
+++ b/app/Http/Requests/Auth/LoginRequest.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Strava\Http\Requests\Auth;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class LoginRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            "email" => ["required", "string", "email", "max:255"],
+            "password" => ["required", "string", "max:255"],
+        ];
+    }
+}
diff --git a/app/Http/Requests/Auth/RegisterRequest.php b/app/Http/Requests/Auth/RegisterRequest.php
new file mode 100644
index 0000000..a0bd06a
--- /dev/null
+++ b/app/Http/Requests/Auth/RegisterRequest.php
@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Strava\Http\Requests\Auth;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class RegisterRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            "name" => ["required", "string", "max:255"],
+            "email" => ["required", "string", "email:rfc,dns", "max:255", "unique:users"],
+            "password" => ["required", "string", "min:8", "max:255", "confirmed"],
+        ];
+    }
+}
diff --git a/app/Http/Requests/Auth/ResetPasswordRequest.php b/app/Http/Requests/Auth/ResetPasswordRequest.php
new file mode 100644
index 0000000..31685fb
--- /dev/null
+++ b/app/Http/Requests/Auth/ResetPasswordRequest.php
@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Strava\Http\Requests\Auth;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class ResetPasswordRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            "token" => ["required", "string"],
+            "email" => ["required", "string", "email"],
+            "password" => ["required", "string", "min:8", "max:255", "confirmed"],
+        ];
+    }
+}
diff --git a/app/Models/User.php b/app/Models/User.php
index 3f2c8ff..03125e6 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -11,6 +11,7 @@
 use Laravel\Sanctum\HasApiTokens;
 
 /**
+ * @property int $id
  * @property string $name
  * @property string $email
  * @property string $password
diff --git a/app/Notifications/ForgotPasswordNotification.php b/app/Notifications/ForgotPasswordNotification.php
new file mode 100644
index 0000000..735d503
--- /dev/null
+++ b/app/Notifications/ForgotPasswordNotification.php
@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Strava\Notifications;
+
+use Illuminate\Bus\Queueable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+
+class ForgotPasswordNotification extends Notification
+{
+    use Queueable;
+
+    public function __construct(
+        public string $code,
+    ) {}
+
+    /**
+     * @return array<int, string>
+     */
+    public function via(object $notifiable): array
+    {
+        return ["mail"];
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        return new MailMessage()
+            ->subject("(MRRGroup) MiniStrava - Password Reset Code")
+            ->view("emails.forgotPassword", [
+                "code" => $this->code,
+                "user" => $notifiable,
+            ]);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function toArray(object $notifiable): array
+    {
+        return [];
+    }
+}
diff --git a/bootstrap/app.php b/bootstrap/app.php
index 1e1695a..ec535e9 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -9,6 +9,7 @@
 return Application::configure(basePath: dirname(__DIR__))
     ->withRouting(
         web: __DIR__ . "/../routes/web.php",
+        api: __DIR__ . "/../routes/api.php",
         commands: __DIR__ . "/../routes/console.php",
         health: "/up",
     )
diff --git a/resources/views/emails/forgotPassword.blade.php b/resources/views/emails/forgotPassword.blade.php
new file mode 100644
index 0000000..7137f09
--- /dev/null
+++ b/resources/views/emails/forgotPassword.blade.php
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <title>Password Reset Code</title>
+</head>
+<body style="font-family: Arial, sans-serif; background: #f9f9f9; padding: 30px;">
+<div style="max-width: 600px; margin: 0 auto; background: white; padding: 40px; border-radius: 10px; box-shadow: 0 4px 12px rgba(0,0,0,0.1);">
+    <h2 style="color: #333;">Hello {{ $user->name ?? 'there' }}</h2>
+    <p style="font-size: 16px; color: #555;">
+        We received a request to reset your account password.
+    </p>
+    <p style="font-size: 16px; color: #555;">
+        Your 6-digit reset code is:
+    </p>
+    <div style="font-size: 32px; font-weight: bold; background: #f0f0f0; padding: 15px 25px; text-align: center; border-radius: 8px; letter-spacing: 5px; color: #222;">
+        {{ $code }}
+    </div>
+    <p style="font-size: 14px; color: #999; margin-top: 20px;">
+        This code will expire in 60 minutes. If you didn't request a password reset, feel free to ignore this message.
+    </p>
+    <hr style="margin-top: 30px;">
+    <p style="font-size: 12px; color: #bbb; text-align: center;">
+        &copy; {{ date('Y') }} MRR Group. All rights reserved.
+    </p>
+</div>
+</body>
+</html>
diff --git a/routes/api.php b/routes/api.php
index 9a2e8ec..55af1e1 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -5,5 +5,20 @@
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Route;
+use Strava\Http\Controllers\Auth\LoginController;
+use Strava\Http\Controllers\Auth\LogoutController;
+use Strava\Http\Controllers\Auth\PasswordController;
+use Strava\Http\Controllers\Auth\RegisterController;
 
 Route::middleware("auth:sanctum")->get("/user", fn(Request $request): JsonResponse => new JsonResponse($request->user()));
+
+Route::middleware(["auth:sanctum"])->group(function (): void {
+    Route::post("/auth/logout", [LogoutController::class, "logout"])->name("logout");
+
+    Route::post("/user/change-password", [PasswordController::class, "changePassword"])->name("change-password");
+});
+
+Route::post("/auth/login", [LoginController::class, "login"])->name("login");
+Route::post("/auth/register", [RegisterController::class, "register"])->name("register");
+Route::post("/auth/forgot-password", [PasswordController::class, "sendResetEmail"])->name("forgot-password");
+Route::post("/auth/reset-password", [PasswordController::class, "resetPassword"])->name("reset-password");