Auth Service — OpenAPI
The auth service handles email/password login and JWT token exchange. It stores users in PostgreSQL (the users table) and verifies passwords with bcrypt.
Accessing the Spec
| Swagger UI | http://localhost:8009/docs |
| ReDoc | http://localhost:8009/redoc |
| OpenAPI JSON | http://localhost:8009/openapi.json |
These URLs access the service directly (port 8009), bypassing the API gateway. In production, use the gateway at port 8000.
Route Prefixes
/auth/token— Exchange email + password for a JWT token (also sets theaegis_tokencookie since R42a)/auth/resolve— JWT → DB-fresh identity + roles + permissions (internal; R42a)/auth/me,/auth/refresh,/auth/logout,/auth/logout-all— Session endpoints (R42a)/auth/admin/users— Admin user lifecycle: create-with-invite, list, patch, reset-password (R42a)/auth/invites/{token},/auth/invites/redeem— Public invite validation/redemption (R42a)/auth/validate— Validate a JWT token (legacy claims-only check)/auth/forward-auth— Method-agnostic check of theaegis_tokencookie or Bearer header (used by Caddy); DB-fresh since R42a, stampsX-Permissionsalongside the identity headers/auth/users— Tenant user directory (admin-only, JWT resolved in-service; proxied at/api/v1/auth/users). Feeds the Platform Settings page’s user picker
Key models: TokenRequest (email, password), TokenResponse (expires_in, user_id, roles, email, display_name — since R42b the JWT rides only in the Set-Cookie header, so the body no longer carries access_token), ResolveResponse (valid, reason, user_id, email, display_name, tenant_id, roles, permissions), AdminUser (id, email, display_name, roles, is_active, status, created_at), ValidateResponse (valid, user_id, roles), UserSummary (id, email, display_name, roles, is_active).
For local development, log in with admin@aegis.local / aegis-dev-admin (the seeded bootstrap admin).