Audience: Application developers
Editorial status: Published — Source Validated
Product: FeraAuth
Classification: public

Credentials and session security

Interactive and service login requires a target instance, source-IP whitelist acceptance, and instance-scoped CAN.LOGIN. Interactive login verifies email/password with bcrypt. Service login maps x-api-key to a special identity without exposing key material in logs. Success creates a persisted session and a JWT that expires.

Authenticated administration sends that JWT in x-auth-token, not the standard Authorization header. Middleware verifies the JWT; sensitive handlers also verify the persisted session and endpoint-specific permission. A token does not by itself confer access to another instance.

CalDAV credential verification is a privileged partner endpoint: the caller first authenticates with x-auth-token and needs AUTH.CALDAV.VERIFY; FeraAuth then verifies the end user’s username/password and user-instance association. API-key permission checks use x-api-key plus the target instance context.

Never log or commit passwords, API keys, reset tokens, challenge codes/tokens, JWTs, or the configured JWT secret.

Source

feradelinc/feradel.auth.api branch agent/auth-security-hardening, commit 8e09b7213fdbc5e0e1552d5271dbeee768e9dd88
docs/api/authentication.md