Authentication

All endpoints except health, config and provider callbacks require a bearer token.

Getting a token

curl -X POST https://YOUR_DOMAIN/api/auth/token \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "..."}'

Use it on every subsequent call:

Authorization: Bearer <token>

Tokens are signed with ENCRYPT_KEY and expire after ACCESS_TOKEN_EXPIRE_MINUTES (120 by default). Refresh with POST /api/auth/refresh-token; POST /api/auth/logout clears the refresh cookie.

Account lifecycle

Method	Endpoint	Description
POST	`/api/auth/forgot-password`	Start a password reset
POST	`/api/auth/reset-password`	Complete it with the emailed token
POST	`/api/auth/verify-email`	Confirm an address
POST	`/api/auth/resend-verification`	Send the confirmation again

What is not here

Two things belong to commercial editions and are absent from this build:

Signing in with an identity provider — GitHub, Google, Microsoft, LinkedIn. The open-source core authenticates with email and password only.
Multi-factor authentication. /api/auth/mfa/* does not exist; it answers 404.

See Editions. Do not read those 404s as a missing object — they mean the capability is not in this edition.

ENCRYPT_KEY signs tokens. If it is empty, token verification degenerates: a required secret that receives an empty string can make forged tokens acceptable. Refuse to boot without it rather than defaulting it.

Overview

Endpoints

Getting a token

Account lifecycle

What is not here

​Getting a token

​Account lifecycle

​What is not here

Getting a token

Account lifecycle

What is not here