admin

The owner signs in with the admin password. No key.

The owner's password sign-in for hookdetector.com/admin. Send {"password": "..."}; the answer is a web sign-in key (all scopes, 30 days, at most 3 per account) for the owner's account, the first email of HD_ADMIN_EMAILS, created on first use exactly as a Google sign-in would create it. A wrong password is 401 invalid_admin_password. Failed tries are limited to 5 per address per 15 minutes and 20 from all addresses per hour (429 with Retry-After, the right password included). 503 admin_password_unavailable when the server holds no valid HD_ADMIN_PASSWORD_HASH or no HD_ADMIN_EMAILS. The password is never stored or logged. Browser only: no MCP tool. From the web's own origin the key is also set in the session cookie (FAILURE_MODES.md WS14).

post/v1/auth/admin-signin

Request

Base URL: https://api.hookdetector.com (the document declares no server; this is the origin it was published from)
URL: https://api.hookdetector.com/v1/auth/admin-signin
Auth: none declared

Request body

passwordstring

the owner's password

Example request

{
  "password": "your password"
}

Response

Successful Response

api_keystring required

a web sign-in key (all scopes, 30 days, at most 3 per account); shown once

key_idstring required

expires_atstring required

Example response

{
  "api_key": "hd_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "expires_at": "2026-09-23T10:00:00.000000+00:00",
  "key_id": "8f1c2d3e-4b5a-4c6d-8e7f-9a0b1c2d3e4f",
  "user": {
    "email": "owner@example.com",
    "is_admin": true
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.