Skip to main content
Human operator authentication is served at /api/auth/*. The dashboard, the CLI, and any custom client use these routes to obtain an operator session. This surface is separate from the /v1 REST API and is not rate-limited under the /v1 bucket.
Once you hold an operator session token, use it as the Authorization: Bearer credential for /v1 management endpoints. See Authentication.

​
Email and password

All four set or read the session cookie, and also accept the cookie via the Cookie header.

​
OAuth (Google / GitHub)

OAuth providers are enabled only when the deployment configures the matching *_CLIENT_ID and *_CLIENT_SECRET environment variables.

​
Device authorization (CLI)

1

Start

The CLI calls device/code and prints the user_code and verification URL.
2

Approve

The user opens the URL in a signed-in browser and approves the code. device/approve and device/deny require an authenticated session.
3

Poll

The CLI polls device/token until the user approves or denies.

​
Bearer tokens

The access token returned by device/token (and sign-in/email) is used in Authorization: Bearer … against any /v1 management endpoint. The CLI holds this token in daemon memory only — it is never written to disk.

Authentication

Token types and the agent keypair session exchange.

Agents

How agents authenticate and access secrets.