# Auth.md

This document describes authentication for scann.

## Base URL

same origin as this document

## Session authentication

Browser clients authenticate with the HTTP-only session cookie issued by `/api/v1/auth/login`.

## Bearer token authentication

API clients may send a JWT access token with:

```http
Authorization: Bearer <token>
```

## API key authentication

Search API clients that support API keys may send:

```http
X-API-Key: <api_key>
```

## Public schema

The public OpenAPI schema is available at `/openapi.json`.