Authentication

Each endpoint page shows its effective security requirements. Operation-level requirements override the API-wide requirements.

BearerAuth

• Type: http bearer
• Description: API key token. Create via POST /api/api-keys. Format: envoy_<hex>
• HTTP scheme: bearer

CookieAuth

• Type: apiKey
• Description: Session cookie set after login + TOTP verification
• Location: cookie
• Name: envoy_session

ExecutorKeyAuth

• Type: http bearer
• Description: Shared executor secret (ENVOY_EXECUTOR_KEY). Used by internal executor-to-control-plane routes (registration, heartbeat, completion/log callbacks).
• HTTP scheme: bearer
• Usage: Internal executor-to-control-plane requests only. Preserve this scheme on executor endpoints.

API-wide requirement

Option 1

• BearerAuth (http bearer) API key token. Create via POST /api/api-keys. Format: envoy_<hex>

Option 2

• CookieAuth (apiKey) Session cookie set after login + TOTP verification

An endpoint with an explicit empty security array is unauthenticated, even when the API defines an API-wide requirement.