Add Bearer token authentication for API access #3

New issue

Open

opened 2026-03-16 21:12:21 +00:00 by austin · 0 comments

austin commented

2026-03-16 21:12:21 +00:00

Owner

The CLI needs a way to authenticate to the API without browser cookies. Currently only cookie-based sessions exist.

What needs to happen

Add a POST /auth/token endpoint (behind auth) that generates and returns a long-lived API token. The token is returned once at creation and never stored in plaintext.

New migration: api_tokens table with columns:

id TEXT PRIMARY KEY
user_id TEXT NOT NULL REFERENCES users(id)
token_hash TEXT NOT NULL (SHA256 — tokens are high-entropy random strings, fast hash is fine)
name TEXT NOT NULL
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
expires_at DATETIME

Auth middleware change: Check for Authorization: Bearer <token> header in addition to session cookies. On Bearer auth, SHA256 hash the provided token and look it up in api_tokens.

Key files

internal/db/migrations.go — new migration for api_tokens table
internal/auth/ — middleware update to check Bearer header
internal/api/server.go — new route for POST /auth/token

The CLI needs a way to authenticate to the API without browser cookies. Currently only cookie-based sessions exist. ## What needs to happen Add a `POST /auth/token` endpoint (behind auth) that generates and returns a long-lived API token. The token is returned once at creation and never stored in plaintext. **New migration:** `api_tokens` table with columns: - `id` TEXT PRIMARY KEY - `user_id` TEXT NOT NULL REFERENCES users(id) - `token_hash` TEXT NOT NULL (SHA256 — tokens are high-entropy random strings, fast hash is fine) - `name` TEXT NOT NULL - `created_at` DATETIME DEFAULT CURRENT_TIMESTAMP - `expires_at` DATETIME **Auth middleware change:** Check for `Authorization: Bearer <token>` header in addition to session cookies. On Bearer auth, SHA256 hash the provided token and look it up in `api_tokens`. ## Key files - `internal/db/migrations.go` — new migration for `api_tokens` table - `internal/auth/` — middleware update to check Bearer header - `internal/api/server.go` — new route for `POST /auth/token`