# Key flows

## Auth

```mermaid
sequenceDiagram
    Client->>API: POST /auth/login
    API->>DB: verify user
    API-->>Client: JWT access + refresh
    Client->>API: Bearer token on requests
    API->>ApiPipeline: rate limit, tenant resolve, RBAC
```

## Marketplace checkout

```mermaid
sequenceDiagram
    Client->>API: POST cart/items (multi vendor)
    Client->>API: POST cart/pay/init
    Client->>Razorpay: pay once
    Client->>API: POST cart/checkout + signature
    API->>DB: split vendor orders + payouts
```

## Daily backup

```mermaid
flowchart LR
    Cron-->BackupService
    BackupService-->mysqldump
    BackupService-->LocalStorage
    BackupService-->R2Optional
```