Authentication

Browser sessions and two-factor authentication. Scripts use API tokens instead.

7 endpoints

POST/api/v1/auth/login

Starts a browser session (httpOnly cookie). When two-factor authentication is on, the session waits for POST /auth/mfa. Rate-limited to 10 requests per minute.

Request body

usernamestringrequired
min. 1 chars, max. 200 chars
passwordstringrequired
min. 1 chars, max. 500 chars

Example

curl -X POST "https://panel.example.com/api/v1/auth/login" \
  -H "Authorization: Bearer $TRIXOS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"your-password"}'

Enter the two-factor code

POST/api/v1/auth/mfa

Completes a sign-in that is waiting for the TOTP code.

Request body

codestringrequired
pattern ^\d{6}$

Example

curl -X POST "https://panel.example.com/api/v1/auth/mfa" \
  -H "Authorization: Bearer $TRIXOS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"code":"123456"}'

Sign out

POST/api/v1/auth/logout

Example

curl -X POST "https://panel.example.com/api/v1/auth/logout" \
  -H "Authorization: Bearer $TRIXOS_TOKEN"

Current user

GET/api/v1/auth/me

The signed-in user or token owner, with role and permissions.

Example

curl "https://panel.example.com/api/v1/auth/me" \
  -H "Authorization: Bearer $TRIXOS_TOKEN"

Start two-factor setup

POST/api/v1/auth/totp/setup

Returns a new TOTP secret and its otpauth:// URI for the authenticator app.

Example

curl -X POST "https://panel.example.com/api/v1/auth/totp/setup" \
  -H "Authorization: Bearer $TRIXOS_TOKEN"

Turn on two-factor authentication

POST/api/v1/auth/totp/enable

Confirms the secret from setup with a current code.

Request body

secretstringrequired
min. 16 chars, max. 64 chars
codestringrequired
pattern ^\d{6}$

Example

curl -X POST "https://panel.example.com/api/v1/auth/totp/enable" \
  -H "Authorization: Bearer $TRIXOS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"secret":"secret","code":"123456"}'

Turn off two-factor authentication

POST/api/v1/auth/totp/disable

Request body

codestringrequired
pattern ^\d{6}$

Example

curl -X POST "https://panel.example.com/api/v1/auth/totp/disable" \
  -H "Authorization: Bearer $TRIXOS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"code":"123456"}'