Authentication

Operator login

curl -X POST http://localhost:8080/api/auth/login \
  -H 'content-type: application/json' \
  -d '{"email":"admin@localhost","password":"changeme"}'

Returns { "token": "…" }. Used when V5_AUTH_MODE=admin. Hosted / Supabase mode uses the Supabase session instead.

API keys

Create under Settings or POST /api/keys. The secret is shown once. Prefix v5_live_. Send as Authorization: Bearer. API keys.

GET /api/me

Returns the current principal when a valid JWT or key is present. Some GET routes currently degrade without auth for local demo — treat production as authenticated.