Skip to content

auth.md

Latest commit

 

History

History
81 lines (51 loc) · 2.04 KB

auth.md

File metadata and controls

81 lines (51 loc) · 2.04 KB

Authentication

This document describes how authentication works in the Misca platform and how clients should interact with protected APIs.

Overview

Misca uses JWT Bearer Authentication for all protected endpoints.
Public endpoints (such as public menu pages) do not require authentication.

Authentication is required for:

  • Workspace APIs
  • Business panel APIs
  • Admin APIs

Token Type

  • Type: JWT (JSON Web Token)
  • Transport: Authorization header
  • Scheme: Bearer

Example: Authorization: Bearer <ACCESS_TOKEN>

Sign In

Authentication is performed by sending credentials to the authentication endpoint.
Upon successful authentication, the API returns an access token.

The access token must be included in all subsequent protected requests.

Token Payload

The JWT payload includes:

  • User identifier
  • Token expiration time
  • Required claims for authorization

The expiration time is provided as a Unix timestamp.

Token Expiration

  • Tokens are time-limited
  • Expiration time is not hard-coded
  • Token lifetime is configurable on the server

Clients are responsible for handling token expiration and re-authentication.

Authorization Scopes

Misca APIs are separated into logical scopes:

  • Public / Auth
    Authentication and public access endpoints

  • Workspace / Panel
    Business and menu management APIs

  • Admin
    Administrative and system-level APIs

Access to each scope is validated based on the authenticated user and token claims.

Unauthorized Responses

If a request is made without a valid token, the API will respond with:

  • 401 Unauthorized – Missing or invalid token
  • 403 Forbidden – Insufficient permissions

Error responses follow the standard API response format.

Security Notes

  • Always store tokens securely on the client
  • Never expose tokens in URLs
  • Use HTTPS for all API requests
  • Rotate tokens when compromised

API Reference

For exact authentication endpoints, request bodies, and response schemas, refer to the Swagger documentation linked in the API section.