From ec70060ae5fa665953741da921e28031b56bc5e0 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:09 +0100 Subject: auth: logging in, and tokens as bearers POST /auth/login (by htpasswd or the proxy), /auth/refresh, /auth/logout, GET /auth/whoami; every request may bring Authorization: Bearer instead of a password. --token-lifetime and --session-lifetime. Auth plan M2. --- docs/api.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'docs/api.md') diff --git a/docs/api.md b/docs/api.md index 5486378..8c4a534 100644 --- a/docs/api.md +++ b/docs/api.md @@ -31,9 +31,10 @@ curl -u alice:secret -X POST 'localhost:3000/store/stats/visits?increment=1' # * Bodies are JSON (`application/json`, the default), text (`text/plain`, stored as a string), or a value of a type of its own (Types); answers are JSON, or as `Accept` asks. Numbers in JSON are stored as integers where they fit, as floats otherwise. -* Every request needs a user from the node's `--htpasswd` (basic authentication), or +* Every request needs a user from the node's `--htpasswd` (basic authentication), named by a reverse proxy in front that authenticated it (`--user-header`; - [`operations.md`](operations.md), Behind a reverse proxy). What each may do, the swarm's user + [`operations.md`](operations.md), Behind a reverse proxy), or a token from logging in on any node + of the swarm (`Authorization: Bearer`, [`access.md`](access.md), Tokens). What each may do, the swarm's user registry says, by path ([`access.md`](access.md)): `403` where it doesn't let the user, and of a part it may only partly read, a read shows the keys on the way to what it may. In a swarm without a registry, users are all alike: each can read and write -- cgit v1.3.1