Phoenix JSON API

RULES — Follow these with no exceptions

1. Use the :api pipeline — don't mix HTML and JSON pipelines; API routes skip CSRF, sessions, and browser headers
2. Render errors as structured JSON — {:error, changeset} must become {"errors": {...}}; never return raw text or HTML errors
3. Use offset/limit for pagination — never return unbounded collections; default to a sensible limit (e.g., 20)
4. Version APIs via URL prefix (/api/v1/) — not headers; URL versioning is visible, cacheable, and debuggable
5. Use FallbackController for consistent error handling — every action returns {:ok, result} or {:error, reason}; the fallback renders errors
6. Authenticate via Bearer tokens in Authorization header — not cookies; API clients don't have browser sessions
7. Use json/2 helper — ensures Content-Type: application/json; avoid render for simple JSON responses

API Pipeline Setup

# lib/my_app_web/router.ex
defmodule MyAppWeb.Router do