Authentication

Runsite Platform uses JWT (JSON Web Tokens) for authentication. Multiple authentication methods are supported.

Token Types

Token	Lifetime	Purpose
Access token	30 minutes	Authorize API requests
Refresh token	7 days	Obtain new access tokens

Auth Flow

1. Register — POST /api/auth/register with email, password, and name
2. Login — POST /api/auth/login returns access + refresh tokens
3. Use API — include Authorization: Bearer <access_token> header
4. Refresh — POST /api/auth/refresh with refresh token when access token expires
5. Logout — POST /api/auth/logout to invalidate the session

Google OAuth

Runsite supports Google OAuth for one-click sign-in.

1. Get OAuth URL — GET /api/auth/google/url returns the Google consent page URL
2. Callback — GET /api/auth/google/callback handles the redirect from Google and creates the session

The frontend redirects the user to the Google URL, and the callback automatically sets authentication cookies.

Frontend Token Handling

The frontend stores tokens in localStorage and uses Axios interceptors to:

• Automatically attach the access token to every request
• Queue requests on 401 and refresh the token transparently
• Redirect to login if refresh fails

API Key Authentication

For programmatic access (CI/CD, CLI tools, integrations), you can use API keys instead of JWT tokens.

API keys use the Authorization: Bearer ak_live_... header — the same header as JWT, so switching between them is seamless.

See API Keys for details on creating and managing keys.

User Profile

Get current user

GET /api/users/me

Upload avatar

POST /api/users/me/avatar
Content-Type: multipart/form-data

file: <avatar.png>

Remove avatar

DELETE /api/users/me/avatar