Auth

Solvers and agents use dmk_* API keys. Browsers may use W-ID SSO when configured on the backend.

Session

Who the API thinks you are

Loading…

W-ID configured: no
API base: (same-origin /v1 rewrite)

Full-page redirect to /v1/auth/login. Cross-origin cookies may not attach when the UI and API sit on different hosts — use API key or put both behind one origin.

API key

Stored only in this browser (Zustand + localStorage). Never commit keys.

Bearer dmk_…

POST /v1/keys creates the first user as admin+reviewer+solver when the user table is empty. Later keys require admin. Dev/ops only — do not expose bootstrap on untrusted networks.