Authentication — MDDB API
User authentication with JWT tokens and API keys
Login #
POST /v1/auth/login
Authenticate with username and password to receive a JWT token.
The token should be included in subsequent requests via the Authorization: Bearer <token> header.
Authorization: BearerAuth or APIKeyAuth or none
Request body #
Required.
Content type application/json: LoginRequest
{
"password": "secret",
"username": "admin"
}
Responses #
| Status | Description | Body |
|---|---|---|
200 |
Login successful | LoginResponse (application/json) |
400 |
Invalid request | ErrorResponse (application/json) |
401 |
Invalid credentials | ErrorResponse (application/json) |
Create API key #
POST /v1/auth/api-key
Create a new API key for the authenticated user. The key is returned only once in the response.
Use the X-API-Key header to authenticate with the key in subsequent requests.
Authorization: BearerAuth
Request body #
Required.
Content type application/json: CreateAPIKeyRequest
{
"description": "CI/CD pipeline key",
"expiresAt": 0
}
Responses #
| Status | Description | Body |
|---|---|---|
200 |
API key created (key shown only once) | CreateAPIKeyResponse (application/json) |
400 |
Invalid request | ErrorResponse (application/json) |
401 |
Authentication required | ErrorResponse (application/json) |
List API keys #
GET /v1/auth/api-keys
List all API keys for the authenticated user (key values are not included, only hashes).
Authorization: BearerAuth
Responses #
| Status | Description | Body |
|---|---|---|
200 |
List of API keys | ListAPIKeysResponse (application/json) |
401 |
Authentication required | ErrorResponse (application/json) |
Delete API key #
DELETE /v1/auth/api-keys/{keyHash}
Delete an API key by its hash. Users can only delete their own API keys.
Authorization: BearerAuth
Parameters #
| Name | In | Type | Description |
|---|---|---|---|
keyHash (required) |
path | string |
SHA256 hash of the API key |
Responses #
| Status | Description | Body |
|---|---|---|
200 |
API key deleted | object (application/json) |
400 |
Key hash required | ErrorResponse (application/json) |
401 |
Authentication required | ErrorResponse (application/json) |
403 |
Forbidden (can only delete own keys) | ErrorResponse (application/json) |
404 |
API key not found | ErrorResponse (application/json) |
Get current user info #
POST /v1/auth/me
Returns information about the currently authenticated user.
Authorization: BearerAuth
Responses #
| Status | Description | Body |
|---|---|---|
200 |
Current user info | GetMeResponse (application/json) |
401 |
Authentication required | ErrorResponse (application/json) |
404 |
User not found | ErrorResponse (application/json) |