Authentication

The Admin API uses JWT bearer tokens. Tokens expire after 24 hours.

Obtaining a token

curl --fail --silent --show-error \
  -X POST "http://localhost:3001/api/auth/admin/login" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "admin",
    "password": "your-password",
    "recaptchaToken": ""
  }' | jq

Response

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": 1,
    "username": "admin",
    "email": "[email protected]",
    "mustChangePassword": false
  }
}

Using the token

Pass the token in the Authorization header for all subsequent requests:

curl -H "Authorization: Bearer $TOKEN" http://localhost:3001/api/admin/events

PicPeak also sets an admin_token cookie on login, but for scripting, the bearer header is recommended.

Token types

PicPeak uses typed JWT tokens:

The middleware validates that the token type matches the endpoint requirements.

Token expiration

Admin tokens expire after 24 hours. Log in again to get a fresh token.

Logout and revocation

In builds containing PicPeak PR #1359 , admin, gallery and customer logout also handle signed JWTs without an exp claim: their revocation records are retained permanently and are not removed by expiry cleanup.

If revocation cannot be persisted, logout returns HTTP 500 while still clearing the authentication cookies. Cookie removal alone does not confirm server-side revocation; a copy of the token may remain usable. API clients should check the response status and report the failure, and operators should check backend logs and database availability.