Log in

Exchanges the shared operator token (ORCH_AUTH_TOKEN) for an HttpOnly fuse_session cookie (SameSite=Lax, Secure when the server serves TLS or ORCH_SECURE_COOKIES=true, 7-day Max-Age) so browser callers never store the token in JavaScript-readable storage. Only the master token is accepted here — not revocable API keys. Mounted outside bearer auth (but behind the CIDR allowlist). When the orchestrator runs with no auth token configured, login returns a no-op 204 regardless of body and sets no cookie. That keeps the SPA flow working only when the API key store is also absent (no DATABASE_URL), because bearer auth is a pass-through only when both are unset. With ORCH_AUTH_TOKEN empty but DATABASE_URL set — a supported configuration — the 204 is a false success: no fuse_session cookie is issued and every subsequent /v1 call fails 401 unauthorized with “missing or malformed credentials”.

curl -X POST "http://localhost:8080/login" \
  -H "Content-Type: application/json" \
  -d '{
  "token": "string"
}'

const response = await fetch("http://localhost:8080/login", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
  "token": "string"
})
});

import requests

response = requests.post(
    "http://localhost:8080/login",
    headers={
        "Content-Type": "application/json"
    },
    json={
  "token": "string"
},
)

{
  "error": {
    "code": "not_found",
    "message": "string",
    "details": {}
  }
}

{
  "error": {
    "code": "not_found",
    "message": "string",
    "details": {}
  }
}