Authentication#
Two routes. Only one is currently usable.
JWT — user identity#
| Endpoint | What it does |
|---|---|
POST /api/system/auth/login |
signs in, returns a token pair |
POST /api/system/auth/refresh |
refreshes the pair |
POST /api/system/auth/logout |
signs out |
GET /api/system/auth/me |
the signed-in user's profile |
GET /api/system/auth/is-auth-valid |
verifies a token |
POST /api/system/auth/login-external |
sign-in via an outside service |
You sign in with a username, not an email
The field is username and the system uses it to find the user. An email does not work.
The request body#
Form encoding, not JSON
The authentication endpoints are the only ones that read a request body — and only a form-encoded one. A JSON body is not read.
The header#
Lifetimes#
| Token | Lifetime |
|---|---|
| Access | 15 minutes |
| Refresh | 60 days, rotated |
Rotation and theft detection#
Every refresh returns a new pair. The old refresh token stops working.
Using an old refresh token invalidates the whole chain
The system treats it as theft and signs you out too. The response carries code
103. Always store the most recently returned pair.
Signing out is immediate#
Signing out puts the access token on a deny list.
Your client must handle a 401 at any time
Not only after fifteen minutes. Signing out on another device invalidates the token at once.
🔴 The server-to-server key currently provides no access#
An X-API-Key header exists and clients can be created in the system.
In the current version the key is unusable
Client authorisation is built on scopes that no action currently declares. The key verifies, but authorisation ends in a denial. Integrate using a user token.
How the key will behave once it works:
| Error | Response |
|---|---|
| Unknown or revoked key | 401 |
| Missing scope | 401 |
A key has no user identity
It has no roles and cannot prove ownership of a record. Where "my advert" is needed, a key will not help even once it works.
Sign-in via an outside service#
The sign-in flow itself (redirects, code exchange) runs on the client. The API only accepts the result — the provider and the identifier.
Failed attempts#
They are written to the audit log and to a table. The sign-in endpoint has a limit of 5 failed attempts per 5 minutes.