API Documentation

Authentication

After registering or logging in, you'll receive a signed token. Include it on every request to a protected endpoint:

Authorization: Bearer <your token>

Signing algorithm

Tokens are signed using RS256. If you're integrating a service that needs to verify tokens independently, our public key is available at:

GET /public-key

Endpoints

GET /api/whoami — returns the username and role encoded in your token.

GET /api/admin — admin-only endpoint.