Get started

Authentication

The NodeFoundry API uses JWT tokens stored in HTTP-only cookies. After logging in, the browser automatically sends the tokens with every request — no manual Authorization header needed.

How it works

  1. Call POST /user/login with username and password
  2. The response sets two cookies: access_token (short-lived) and refresh_token (long-lived)
  3. All subsequent requests include these cookies automatically
  4. When the access token expires, call POST /user/refresh to get a new one
  5. Call POST /user/logout to invalidate the session

S3 authentication

S3 endpoints use a separate credential system. Pass your RGW access and secret keys via headers:

HeaderDescription
X-S3-Access-KeyS3 access key from RGW user
X-S3-Secret-KeyS3 secret key from RGW user

These can also be passed as query parameters: ?accessKey=...&secretKey=...

Unauthenticated endpoints

The following endpoints do not require authentication:

  • POST /user/login
  • POST /user/refresh
  • GET /boot/config (iPXE boot)
  • GET /boot/default (iPXE default)
  • GET /templates/rendered/{name} (rendered templates)