diff --git a/backend/docs/docs.go b/backend/docs/docs.go
index 6a803dc..7ed931c 100644
--- a/backend/docs/docs.go
+++ b/backend/docs/docs.go
@@ -15,6 +15,96 @@ const docTemplate = `{
     "host": "{{.Host}}",
     "basePath": "{{.BasePath}}",
     "paths": {
+        "/auth/login": {
+            "post": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Acquire tokens via login credentials or by providing 2FA code",
+                "responses": {}
+            }
+        },
+        "/auth/passwordResetBegin": {
+            "post": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Request password reset email",
+                "responses": {}
+            }
+        },
+        "/auth/passwordResetComplete": {
+            "post": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Complete password reset with email code and provide 2FA code or backup code if needed",
+                "responses": {}
+            }
+        },
+        "/auth/refresh": {
+            "post": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Receive new tokens via refresh token",
+                "responses": {}
+            }
+        },
+        "/auth/registrationBegin": {
+            "post": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Register an account",
+                "responses": {}
+            }
+        },
+        "/auth/registrationComplete": {
+            "post": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Confirm with code, finish creating the account",
+                "responses": {}
+            }
+        },
         "/service/health": {
             "get": {
                 "description": "Used internally for checking service health",
diff --git a/backend/docs/swagger.json b/backend/docs/swagger.json
index 437dfa4..170b194 100644
--- a/backend/docs/swagger.json
+++ b/backend/docs/swagger.json
@@ -4,6 +4,96 @@
         "contact": {}
     },
     "paths": {
+        "/auth/login": {
+            "post": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Acquire tokens via login credentials or by providing 2FA code",
+                "responses": {}
+            }
+        },
+        "/auth/passwordResetBegin": {
+            "post": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Request password reset email",
+                "responses": {}
+            }
+        },
+        "/auth/passwordResetComplete": {
+            "post": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Complete password reset with email code and provide 2FA code or backup code if needed",
+                "responses": {}
+            }
+        },
+        "/auth/refresh": {
+            "post": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Receive new tokens via refresh token",
+                "responses": {}
+            }
+        },
+        "/auth/registrationBegin": {
+            "post": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Register an account",
+                "responses": {}
+            }
+        },
+        "/auth/registrationComplete": {
+            "post": {
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Confirm with code, finish creating the account",
+                "responses": {}
+            }
+        },
         "/service/health": {
             "get": {
                 "description": "Used internally for checking service health",
diff --git a/backend/docs/swagger.yaml b/backend/docs/swagger.yaml
index 359b167..7914358 100644
--- a/backend/docs/swagger.yaml
+++ b/backend/docs/swagger.yaml
@@ -7,6 +7,67 @@ definitions:
 info:
   contact: {}
 paths:
+  /auth/login:
+    post:
+      consumes:
+      - application/json
+      produces:
+      - application/json
+      responses: {}
+      summary: Acquire tokens via login credentials or by providing 2FA code
+      tags:
+      - Auth
+  /auth/passwordResetBegin:
+    post:
+      consumes:
+      - application/json
+      produces:
+      - application/json
+      responses: {}
+      summary: Request password reset email
+      tags:
+      - Auth
+  /auth/passwordResetComplete:
+    post:
+      consumes:
+      - application/json
+      produces:
+      - application/json
+      responses: {}
+      summary: Complete password reset with email code and provide 2FA code or backup
+        code if needed
+      tags:
+      - Auth
+  /auth/refresh:
+    post:
+      consumes:
+      - application/json
+      produces:
+      - application/json
+      responses: {}
+      summary: Receive new tokens via refresh token
+      tags:
+      - Auth
+  /auth/registrationBegin:
+    post:
+      consumes:
+      - application/json
+      produces:
+      - application/json
+      responses: {}
+      summary: Register an account
+      tags:
+      - Auth
+  /auth/registrationComplete:
+    post:
+      consumes:
+      - application/json
+      produces:
+      - application/json
+      responses: {}
+      summary: Confirm with code, finish creating the account
+      tags:
+      - Auth
   /service/health:
     get:
       consumes:
diff --git a/backend/internal/controllers/auth.go b/backend/internal/controllers/auth.go
new file mode 100644
index 0000000..9afd047
--- /dev/null
+++ b/backend/internal/controllers/auth.go
@@ -0,0 +1,63 @@
+package controllers
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// @Summary Register an account
+// @Tags Auth
+// @Accept json
+// @Produce json
+// @Router /auth/registrationBegin [post]
+func RegistrationBegin(c *gin.Context) {
+	c.Status(http.StatusNotImplemented)
+}
+
+// @Summary Confirm with code, finish creating the account
+// @Tags Auth
+// @Accept json
+// @Produce json
+// @Router /auth/registrationComplete [post]
+func RegistrationComplete(c *gin.Context) {
+	c.Status(http.StatusNotImplemented)
+}
+
+// TODO: Document instructions on 2FA
+// @Summary Acquire tokens via login credentials or by providing 2FA code
+// @Tags Auth
+// @Accept json
+// @Produce json
+// @Router /auth/login [post]
+func Login(c *gin.Context) {
+	c.Status(http.StatusNotImplemented)
+}
+
+// @Summary Receive new tokens via refresh token
+// @Tags Auth
+// @Accept json
+// @Produce json
+// @Router /auth/refresh [post]
+func Refresh(c *gin.Context) {
+	c.Status(http.StatusNotImplemented)
+}
+
+// @Summary Request password reset email
+// @Tags Auth
+// @Accept json
+// @Produce json
+// @Router /auth/passwordResetBegin [post]
+func PasswordResetBegin(c *gin.Context) {
+	c.Status(http.StatusNotImplemented)
+}
+
+// TODO: Document instructions on 2FA
+// @Summary Complete password reset with email code and provide 2FA code or backup code if needed
+// @Tags Auth
+// @Accept json
+// @Produce json
+// @Router /auth/passwordResetComplete [post]
+func PasswordResetComplete(c *gin.Context) {
+	c.Status(http.StatusNotImplemented)
+}
diff --git a/backend/internal/routes/setup.go b/backend/internal/routes/setup.go
index d468438..3b371f2 100644
--- a/backend/internal/routes/setup.go
+++ b/backend/internal/routes/setup.go
@@ -13,6 +13,16 @@ func SetupRoutes(r *gin.Engine) *gin.Engine {
 		{
 			serviceGroup.GET("/health", controllers.HealthCheck)
 		}
+
+		authGroup := apiGroup.Group("/auth")
+		{
+			authGroup.POST("/registrationBegin", controllers.RegistrationBegin)
+			authGroup.POST("/registrationComplete", controllers.RegistrationComplete)
+			authGroup.POST("/login", controllers.Login)
+			authGroup.POST("/refresh", controllers.Refresh)
+			authGroup.POST("/passwordResetBegin", controllers.PasswordResetBegin)
+			authGroup.POST("/passwordResetComplete", controllers.PasswordResetComplete)
+		}
 	}
 	
 	return r