omni-auth

Overview

Manage API key authentication and session tokens. Start here to authenticate requests via Bearer token, obtain session cookies, and configure login requirements for the OmniRoute API.

Authentication

Remote API requests use a Bearer credential. Dashboard login is different: POST /api/auth/login accepts a management password and returns an auth_token session cookie.

Endpoints

POST /api/auth/login

Authenticate user

curl -X POST https://localhost:20128/api/auth/login \
  -H "Content-Type: application/json" \
  -c cookie.jar \
  -d '{"password":"<management-password>"}'

POST /api/auth/logout

Log out

CSRF_TOKEN=$(curl -s https://localhost:20128/api/auth/csrf -b cookie.jar | jq -r .token)
curl -X POST https://localhost:20128/api/auth/logout \
  -b cookie.jar \
  -H "x-omniroute-csrf: $CSRF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

GET /api/auth/oidc/login

Start OIDC login for the dashboard admin gate

Builds an authorization URL from the configured OIDC issuer/client (discovered via {issuer}/.well-known/openid-configuration, falling back to {issuer}/authorize), sets a short-lived oidc_state cookie, and redirects the browser. Password login remains available as a fallback while OIDC is enabled.

curl https://localhost:20128/api/auth/oidc/login \
  -b cookie.jar

GET /api/auth/oidc/callback

Complete OIDC login for the dashboard admin gate

Validates the state cookie, exchanges the authorization code for tokens, verifies the ID token against the issuer's JWKS (audience = client id), and — if oidcAllowedSubjects is configured — checks the token's sub/email against that allowlist. On success it mints the same 30-day auth_token dashboard-session JWT used by password login and redirects to /dashboard.

curl https://localhost:20128/api/auth/oidc/callback \
  -b cookie.jar