Authentication and authorization

How requests are authenticated.

The API uses bearer tokens issued after the password and one-time-code steps. The website stores its token in the browser and sends it with API calls.

The extension has its own pairing flow and token, issued under /api/ext. Entitlement and run authorization are decided on the server.

Administrator access is a server-side flag on the user.

Design principles

• Authentication (who you are) is separate from authorization (what you may do).
• Nothing security-relevant is trusted from the client; entitlement and submit authorization are re-checked server-side.
• Tokens can be revoked, which invalidates them immediately.