API authentication
How requests to the panel API are authenticated and protected.
The control-panel API lets you manage services programmatically. Requests are authenticated with a session or API token and protected by the same safeguards as the panel.
Tokens
- Create tokens under Settings → API.
- Scope a token to only the actions it needs.
- Treat tokens like passwords — store them in a secret manager, never in source control.
Making a request
curl -H 'Authorization: Bearer $BERIFFA_TOKEN' \
https://beriffa.com/dash/api/panel/servicesRate limits & CSRF
Panel routes are rate-limited and state-changing requests require a CSRF token when called from a browser session. Server-to-server calls use a bearer token and are exempt from CSRF.