diff --git a/backend/app/Models/User.php b/backend/app/Models/User.php
index f62f69bb..56fbb341 100644
--- a/backend/app/Models/User.php
+++ b/backend/app/Models/User.php
@@ -30,4 +30,5 @@ class User extends Authenticatable
             'password' => 'hashed',
         ];
     }
+    protected $guarded = ['id'];
 }
diff --git a/backend/app/User/Controller/Auth/AuthController.php b/backend/app/User/Controller/Auth/AuthController.php
new file mode 100644
index 00000000..806a637b
--- /dev/null
+++ b/backend/app/User/Controller/Auth/AuthController.php
@@ -0,0 +1,64 @@
+<?php
+
+namespace App\User\Controller\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use App\User\Requests\Auth\LoginRequest;
+use App\User\Requests\Auth\ًRegisterRequest;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Hash;
+
+class AuthController extends Controller
+{
+    public function register(ًRegisterRequest $request): JsonResponse
+    {
+        $user = User::query()->create([
+            'name' => $request->name,
+            'email' => $request->email,
+            'password' => Hash::make($request->password),
+        ]);
+
+        $token = $user->createToken('Register Token')->accessToken;
+
+        return response()->json([
+            'success' => true,
+            'token_type' => 'Bearer',
+            'access_token' => $token,
+            'user' => [
+                'id' => $user->id,
+                'username' => $user->username,
+            ],
+        ], 201);
+    }
+
+    public function login(loginRequest $request): JsonResponse
+    {
+        if ($request->filled('email')) {
+            $user = User::query()
+                ->where('name', $request->name)->first();
+        }
+        elseif ($request->filled('username')) {
+            $user = User::query()
+                ->where('name', $request->name)
+                ->first();
+        }
+
+        if (!$user || !Hash::check($request->password, $user->password)) {
+            return response()->json([
+                'message' => 'Invalid credentials'
+            ], 401);
+        }
+
+        $token = $user->createToken('Login Token')->accessToken;
+
+        return response()->json([
+            'success' => true,
+            'token' => $token,
+            'user' => [
+                'id' => $user->id,
+                'name' => $user->name,
+            ],
+        ]);
+    }
+}
diff --git a/backend/app/User/Requests/Auth/LoginRequest.php b/backend/app/User/Requests/Auth/LoginRequest.php
new file mode 100644
index 00000000..0c727045
--- /dev/null
+++ b/backend/app/User/Requests/Auth/LoginRequest.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\User\Requests\Auth;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class LoginRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => 'required|exists:users,name',
+            'email' => 'required|email|exists:users,email',
+            'password' => 'required|string|regex:/^(?=.*[a-zA-Z])(?=.*\d).+$/|min:8',
+        ];
+    }
+}
diff --git a/backend/app/User/Requests/Auth/ًRegisterRequest.php b/backend/app/User/Requests/Auth/ًRegisterRequest.php
new file mode 100644
index 00000000..b549fc37
--- /dev/null
+++ b/backend/app/User/Requests/Auth/ًRegisterRequest.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\User\Requests\Auth;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class ًRegisterRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => 'required_without:email|unique:users,name',
+            'email' => 'required|email|unique:users,email',
+            'password' => 'required|string|regex:/^(?=.*[a-zA-Z])(?=.*\d).+$/|min:8',
+        ];
+    }
+}
diff --git a/backend/routes/api.php b/backend/routes/api.php
index f35f6f84..608543fc 100644
--- a/backend/routes/api.php
+++ b/backend/routes/api.php
@@ -1,8 +1,19 @@
 <?php
 
+use App\User\Controller\Auth\AuthController;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Route;
 
 Route::get('/user', function (Request $request) {
     return $request->user();
 })->middleware('auth:api');
+
+Route::prefix('user')->group(function () {
+    Route::prefix('Auth')
+        ->namespace('Auth')
+        ->controller(AuthController::class)
+        ->group(function () {
+            Route::post('register', 'register')->name('register');
+            Route::post('login', 'login')->name('login');
+        });
+});