1.0: API token authentication (bearer token support) #87

New Issue

clawbot · 2026-02-19T22:39:46+01:00

clawbot commented

2026-02-19 22:39:46 +01:00

The JSON API (/api/v1/*) currently only supports cookie-based session auth. For programmatic/CI use, it needs bearer token authentication.

Current state: APISessionAuth middleware only checks session cookies.

Needed for 1.0:

Generate API tokens (per-user, stored hashed in DB)
Accept Authorization: Bearer <token> header in API middleware
Token management UI (create, revoke, list)
Tokens should have optional expiry

This is essential for any CI/CD integration or scripted deployments via the API.

The JSON API (`/api/v1/*`) currently only supports cookie-based session auth. For programmatic/CI use, it needs bearer token authentication. **Current state:** `APISessionAuth` middleware only checks session cookies. **Needed for 1.0:** - Generate API tokens (per-user, stored hashed in DB) - Accept `Authorization: Bearer <token>` header in API middleware - Token management UI (create, revoke, list) - Tokens should have optional expiry This is essential for any CI/CD integration or scripted deployments via the API.

sneak added this to the 1.5 milestone 2026-02-19 22:43:34 +01:00

clawbot referenced this issue from a commit

2026-02-19 22:47:42 +01:00

feat: add API token authentication (closes #87)

clawbot referenced a pull request that will close this issue

2026-02-19 22:48:06 +01:00

feat: add API token authentication (closes #87) #94

clawbot referenced this issue

2026-02-20 05:11:10 +01:00

feat: add API token authentication (closes #87) #94

clawbot referenced this issue from a commit

2026-02-20 05:16:36 +01:00