Authentication
JWT and API key authentication for the Savannah Cloud API.
Overview
All protected endpoints require one of:
- JWT token —
Authorization: Bearer <token> - API key —
X-API-Key: sc_...orAuthorization: Bearer sc_... - Session cookie —
Cookie: sc_session=...(set automatically on login)
JWTs are issued on login/register and expire after 30 days. API keys do not expire and are scoped to an organization. Sessions are Redis-backed HttpOnly cookies with a sliding 30-minute TTL.
Register
Creates a new organization and its first owner account.
POST /auth/register
Content-Type: application/jsonRequest body
{
"org_name": "Acme Corp",
"email": "admin@acme.com",
"password": "yourpassword"
}Response 200
{
"token": "eyJhbGci...",
"user": {
"id": "usr_...",
"email": "admin@acme.com",
"role": "owner"
},
"org": {
"id": "org_...",
"name": "Acme Corp"
}
}Login
POST /auth/login
Content-Type: application/jsonRequest body
{
"email": "admin@acme.com",
"password": "yourpassword"
}Response 200
{
"token": "eyJhbGci...",
"user": {
"id": "usr_...",
"email": "admin@acme.com",
"role": "owner"
}
}Get Current User
Returns the authenticated user's profile.
GET /auth/me
Authorization: Bearer <token>Response 200
{
"id": "usr_...",
"email": "admin@acme.com",
"role": "owner",
"org_id": "org_..."
}Logout
Invalidates the Redis session and clears the session cookie.
POST /auth/logout
Authorization: Bearer <token>Response 200
{ "message": "logged out" }Roles
| Role | Permissions |
|---|---|
owner | Full access; can invite and remove members |
admin | Full access; cannot remove the owner |
member | Read/write jobs and API keys; no team management |
Error Responses
| Status | Meaning |
|---|---|
401 | Missing or invalid credentials |
403 | Authenticated but insufficient role |
404 | User not found |
If your JWT expires, the dashboard redirects to /login. Session cookies expire after 30 minutes of inactivity and are renewed on each authenticated request.