diff --git a/app/schemas/auth.py b/app/schemas/auth.py
new file mode 100644
index 0000000..fd414f7
--- /dev/null
+++ b/app/schemas/auth.py
@@ -0,0 +1,61 @@
+"""Pydantic schemas for authentication endpoints."""
+
+from __future__ import annotations
+
+from typing import Optional
+
+from pydantic import BaseModel, EmailStr, Field
+
+from app.models.user import UserRole
+
+
+class UserRegisterRequest(BaseModel):
+    """Request body for POST /api/v1/auth/register (bootstrap)."""
+
+    email: EmailStr
+    password: str = Field(..., min_length=8, max_length=128)
+    name: str = Field(..., min_length=1, max_length=255)
+    role: UserRole = UserRole.sales_rep
+
+
+class UserLoginRequest(BaseModel):
+    """Request body for POST /api/v1/auth/login (form-data or JSON)."""
+
+    email: EmailStr
+    password: str = Field(..., min_length=1, max_length=128)
+
+
+class TokenResponse(BaseModel):
+    """Response body for successful auth (register/login/refresh)."""
+
+    access_token: str
+    token_type: str = "bearer"
+    expires_in: int  # seconds
+
+
+class LogoutResponse(BaseModel):
+    """Response body for POST /api/v1/auth/logout.
+
+    The token is deleted client-side; this endpoint exists for consistency and
+    future server-side blacklisting.
+    """
+
+    message: str = "logged out"
+
+
+class RegisterResponse(BaseModel):
+    """Response body for successful registration.
+
+    Returns the user info (without password) plus an access token.
+    """
+
+    user: "UserOut"
+    access_token: str
+    token_type: str = "bearer"
+    expires_in: int
+
+
+# Late import to avoid circular dependency
+from app.schemas.user import UserOut  # noqa: E402
+
+RegisterResponse.model_rebuild()