Complete Reference

REST API Reference

Comprehensive directory of all endpoints, authentication headers, request payloads, response structures, and rate limits exposed by MBKAuthe.

POST /mbkauthe/api/login

Rate Limit: 8 / min

Authenticates user credentials, sets encrypted session cookie, or prompts 2FA challenge.

Request Body (JSON) {
"username": "john.doe",
"password": "SecurePass123!"
}

Success Response (200 OK) {
  "success": true,
  "message": "Login successful",
  "redirect_url": "/dashboard"
}

POST /mbkauthe/api/verify-2fa

Rate Limit: 5 / min

Verifies 6-digit TOTP token to complete 2FA login challenge.

Request Body (JSON) {
"token": "123456",
"_csrf": "csrf_token"
}

Success Response (200 OK) {
"success": true,
"message": "Login successful"
}

POST /api/token

Auth: Session

Generates a scoped API token with SHA-256 storage hashing.

Request Body (JSON) {
  "name": "CI Bot",
  "scope": "read-only",
  "expiresDays": 30
}

Success Response (201 Created) {
  "success": true,
  "token": "mbk_a1b2c3...",
  "id": 42
}

POST /api/tokens/verify

Public

Validates an API token and returns assigned username, permissions, and expiration.

Request Body (JSON) { "token": "mbk_a1b2c3d4..." }

Success Response (200 OK) {
"tokenValid": true,
"username": "jane"
}

POST /api/cli/device

Rate Limit: 20 / min

Initiates RFC 8628 CLI device flow and generates a verification link and user code.

Request Body (JSON) {
"client_name": "my-cli",
"profile_key": "1362403658a3"
}

Success Response (201 Created) {
  "verification_url": "https://.../XXXX-XXXX",
  "user_code": "XXXX-XXXX",
  "interval": 5
}

GET /mbkauthe/api/checkSession

Auth: Cookie

Checks current cookie session validity and returns expiration timestamp.

Success Response (200 OK) { "session_valid": true, "expiry": "2026-09-14T12:00:00.000Z" }