Appearance
auth
16 endpoints at a glance
| Method | Path | Summary |
|---|---|---|
GET | /auth/api-keys/ | List All Api Keys |
DELETE | /auth/api-keys/{key_id} | Admin Revoke Api Key |
POST | /auth/login | Login |
POST | /auth/logout | Logout |
GET | /auth/me | Me |
PATCH | /auth/me | Update Me |
GET | /auth/me/api-keys | List My Api Keys |
POST | /auth/me/api-keys | Create Api Key |
DELETE | /auth/me/api-keys/{key_id} | Revoke My Api Key |
POST | /auth/me/password | Change Password |
POST | /auth/register | Register |
GET | /auth/users/ | List Users |
POST | /auth/users/ | Create User |
DELETE | /auth/users/{username} | Delete User |
PATCH | /auth/users/{username} | Update User |
POST | /auth/users/{username}/password | Admin Reset Password |
auth
Login
POST
/auth/login
Verify credentials, set the session cookie, return the user.
Generic 401 on any failure — never leak whether the username exists.
Request Body
application/json
JSON "username": "string", "password": "string"
{
}
Responses
Successful Response
application/json
JSON "additionalProperties": "string"
{
}
Register
POST
/auth/register
Self-serve signup. Creates a viewer and auto-logs in.
Admins are still admin-created via POST /auth/users/ —
self-registration intentionally has no role field on the wire.
Request Body
application/json
JSON "username": "string", "password": "string"
{
}
Responses
Successful Response
application/json
JSON "additionalProperties": "string"
{
}
Logout
Me
GET
/auth/me
The current user, and how this request authenticated.
auth is {"via": "cookie"} or {"via": "api_key", "scopes", "prefix"} — what a client holding a key needs to check it is the key
it expects (an MCP server refuses to start on one that can write).
Never the hash.
Parameters
Header Parameters
authorization
x-api-key
Responses
Successful Response
application/json
JSON "additionalProperties": "string"
{
}
Update Me
Change Password
List My Api Keys
Create Api Key
POST
/auth/me/api-keys
Issue a key. The response carries secret — the only time it is
ever shown. Read-only unless scopes asks for write.
Parameters
Header Parameters
authorization
x-api-key
Request Body
application/json
JSON "label": "string", "scopes": [ "string" ], "expires_at_ts": 0
{
}
Responses
Successful Response
application/json
JSON "additionalProperties": "string"
{
}