Reference
Authentication
Use one-hour revocable bearer sessions through the API, or sign in through the dashboard.
Dashboard sessions
Sign in through /login. The dashboard server stores the Go bearer in an HttpOnly cookie and forwards approved requests to the configured Go API.
The browser does not receive the access token in response JSON or store it in localStorage. Dashboard API paths are an adapter, not a replacement for the public Go API paths.
Direct API sessions
POST /api/auth/sign-in/email accepts exactly email and password. A successful login returns accessToken, tokenType, expiresIn, and user.
Send Authorization: Bearer followed by your private access token on protected requests. Use the exact configured public Origin on mutations, including sign-in.
Authorization: Bearer <your-private-access-token>
Origin: https://your-configured-origin.example
Content-Type: application/jsonAccount creation
POST /api/auth/sign-up/email accepts exactly name, email, and password. A successful response creates the account without issuing a session; sign in separately.
Passwords accept 4–128 UTF-16 code units. No password reset, social login, email delivery, or refresh-token flow is installed.
Expiry and sign-out
Sessions expire after one hour. Each authenticated request checks the bearer and its current database session.
POST /api/auth/sign-out revokes the current session. The dashboard clears its cookie after upstream revocation succeeds. Other device sessions remain separate.