API authentication

How requests to the panel API are authenticated and protected.

The control-panel API lets you manage services programmatically. Requests are authenticated with a session or API token and protected by the same safeguards as the panel.

Tokens

Create tokens under Settings → API.
Scope a token to only the actions it needs.
Treat tokens like passwords, store them in a secret manager, never in source control.

Making a request

curl -H 'Authorization: Bearer $BERIFFA_TOKEN' \
     https://beriffa.com/dash/api/panel/services

Rate limits & CSRF

Panel routes are rate-limited and state-changing requests require a CSRF token when called from a browser session. Server-to-server calls use a bearer token and are exempt from CSRF.