Authentication

MasterOS's API uses a single mechanism today: an httpOnly session cookie, set by POST /v1/auth/login (or an OAuth callback) and read by every endpoint that requires session auth in the API reference.

There is no separate API key or bearer-token scheme yet — a request from your own script or server would need to authenticate the same way a browser does, by logging in and reusing the resulting cookie. A dedicated API-key mechanism for third-party/server-to-server integration is planned but not built — see Integrations.

Rate limiting

Login, registration, and password-reset requests are rate-limited independently by IP address and by email/account, so neither limit alone can be bypassed.

Password reset

POST /v1/auth/forgot-password always returns the same response whether or not the email is registered, so a caller can't use it to enumerate real accounts. The reset token itself is single-use and expires after a fixed window.