Skip to content

Overview

Sign-in links, the signed-in user, email change and Google sign-in.

Every route is served through the gateway under /api/user. Errors are RFC 9457 problem details. Routes that act for a user take its access token from Authorization: Bearer or the access_token cookie the auth service sets; unsafe requests from another origin are refused with 403.

Information

  • License: MIT
  • OpenAPI version: 3.1.0

An access token from the auth service.

Security scheme type: http

Bearer format: JWT

The browser session’s access token, set by the auth service.

Security scheme type: apiKey

Cookie parameter name: access_token