dashboard

Exchange an API key for an httpOnly dashboard session cookie.

Unauthenticated (there is no Authorization header at this point in the flow) — the pasted API key travels in the JSON body instead and is verified here via the same resolver requireAuth uses. On success, sets an httpOnly/Secure/SameSite=Strict session cookie; the SPA never sees the bearer token or the session id in JS-readable storage. The request must carry the header X-Coldstart-Client: dashboard; without it the call is refused with 403 and the token is not checked.

post/dashboard/session

Request

  • Base URL: https://api.coldrig.dev
  • URL: https://api.coldrig.dev/dashboard/session
  • Auth: none required

Headers

X-Coldstart-Client'dashboard' required

Must be exactly dashboard.

Request body

tokenstring required

The API key from POST /signup.

Response

Session cookie set.

tenantIdstring required

Changes

No recorded changes to this operation across all 2 revisions of this API.