Svitrio

Authentication

API keys (machines)

Admin endpoints accept a personal API key as Authorization: Bearer sk_live_…. Mint one at POST /admin/api-keys (the plaintext is shown once); scope it and revoke it any time.

curl -H "Authorization: Bearer sk_live_…" \
  https://your-api.svitrio.com/admin/p/{ref}/nodes/

People

Humans sign in without passwords:

  • Magic links — POST /auth/magic → email → POST /auth/magic/verify exchanges the token for a session. Rate-limited per IP and per email.

  • Passkeys (WebAuthn) — discoverable login via /auth/passkeys/login/begin|finish; register more under /auth/passkeys/*. Requires the SVITRIO_WEBAUTHN_* env; otherwise the endpoints return 501 and magic-links still work.

Sessions are short-lived access JWTs (SVITRIO_ACCESS_TTL, default 15m) refreshed via POST /auth/refresh against a longer refresh token (SVITRIO_REFRESH_TTL, 7d).

MCP clients

Agent clients authenticate to the MCP endpoint with an MCP token or the OAuth 2.1 flow — see the AI & MCP API page.

The public API

The delivery API needs no auth at all; it only ever returns published content.