Authentication

Sessions

POST /auth/login with a username and password sets a JWT in an HttpOnly cookie. Every other endpoint reads it back from that cookie.

HttpOnly means scripts in the page cannot read the token. It also means a browser-based client needs to send credentials with its requests rather than attaching an Authorization header.

curl -c jar.txt -X POST https://…/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"me","password":"…"}'

curl -b jar.txt https://…/auth/me

POST /auth/logout clears the cookie.

Registration

POST /auth/register creates an account and signs it in. The role is always viewer and there is no role field on the request — elevation is an admin operation.

Roles

Three: viewer, officer, admin. See Accounts and roles for what each can do.

Endpoints under /admin/ and /auth/users/ require admin.

401 versus 403

401	No valid session — the cookie is missing, expired or malformed. Sign in again.
403	Signed in, but this role may not do this. Signing in again will not help.

There are no API keys

SWGoH has no API-key mechanism. Automation authenticates the same way a browser does: log in, keep the cookie.