Files
OpenArchiver/docs/api/authentication.md
2025-08-15 14:18:23 +03:00

1.5 KiB

API Authentication

To access protected API endpoints, you need to include a JSON Web Token (JWT) in the Authorization header of your requests.

Obtaining a JWT

First, you need to authenticate with the /api/v1/auth/login endpoint by providing your email and password. If the credentials are correct, the API will return an accessToken.

Request:

POST /api/v1/auth/login
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "your-password"
}

Successful Response:

{
	"accessToken": "your.jwt.token",
	"user": {
		"id": "user-id",
		"email": "user@example.com",
		"role": "user"
	}
}

Making Authenticated Requests

Once you have the accessToken, you must include it in the Authorization header of all subsequent requests to protected endpoints, using the Bearer scheme.

Example:

GET /api/v1/dashboard/stats
Authorization: Bearer your.jwt.token

If the token is missing, expired, or invalid, the API will respond with a 401 Unauthorized status code.

Using a Super API Key

Alternatively, for server-to-server communication or scripts, you can use a super API key. This key provides unrestricted access to the API and should be kept secret.

You can set the SUPER_API_KEY in your .env file.

To authenticate using the super API key, include it in the Authorization header as a Bearer token.

Example:

GET /api/v1/dashboard/stats
Authorization: Bearer your-super-secret-api-key