Authentication

INFO

If you use the baseline client library, it will handle authentication for you automatically

Authenticate Requests

Include your token in the Authorization header using the Bearer scheme:

const { data } = await axios.request({
    headers: {
        Authorization: 'Bearer Rsu1TlWaS6SDjakjDkKpGUZO-hsi1zFQVWUNx0m1z4U'
    }
})

To obtain an initial token, call POST /api/auth/login with the user's credentials. Refer to the API reference for the request body schema.

Token Lifecycle

By default, tokens expire after 7 days. Baseline implements "sliding expiration", meaning the expiration timer resets with every successful authenticated request.

You can customize this behavior in Configuration using:

• APP_TOKEN_TTL: The duration (in seconds) before a token expires.
• APP_TOKEN_AUTOREFRESH: Whether the expiration timer resets on every request (defaults to true).

Security Note: Sliding Expiration Risks

Because Baseline uses sliding expiration and allows the issuance of new tokens using an existing valid one, a leaked token can potentially remain valid indefinitely if the attacker continues to use it. For high-security applications, consider reducing the APP_TOKEN_TTL and disabling APP_TOKEN_AUTOREFRESH.

Generate Permanent Tokens

Use the POST /api/auth/token endpoint to allow a user to create custom scripts or third-party integrations where standard session-based flows are not feasible.

Requirement

Generating a permanent token requires an existing, valid, and authenticated user session using a non-permanent token.

Permantent tokens are not allowed to create more permanent tokens.

The config option token_permanent_enabled must be true.

Refer to the API reference for detailed request and response schemas.

Invalidate Tokens

Revoke access by invalidating tokens using the following endpoints:

Endpoint	Method	Description
/api/auth/logout	DELETE	Invalidates the current session token being used.
/api/auth/logout-all	DELETE	Invalidates all active tokens associated with the user across all devices.

Use baseline-client

The baseline-client library automates token storage (via localStorage), request interception for the Authorization header, and automatic token refreshing.

Use the auth module to manage authentication state:

// 1. Initialize the client (loads existing token from storage)
await baseline.auth.init();

// or check if the user is currently authenticated (calls .init() automatically)
const isAllowed = await baseline.auth.isAuthenticated();

// 2. Log in with credentials
await baseline.auth.login("username", "password");

// 3. Access the current user (returns a reactive Vue ref)
const currentUser = baseline.auth.user;

// 4. Log out the user
await baseline.auth.logout();