Authentication

All authenticated routes live under /v1/*. Responses use { ok, data } or { ok: false, error }.

Session cookies (dashboard)

Browser sessions send the session cookie after login. Useful for first-party UI only.

Staff and invited clients can sign in with email/password, Google OAuth, or Microsoft Entra ID when those providers are enabled (GET /v1/auth/providers).

API keys (server-to-server)

Create keys in Settings → API keys. Prefix is fel_.

curl "$API/v1/projects" \
-H "Authorization: Bearer fel_YOUR_KEY"

const res = await fetch(`${API}/v1/projects`, {
headers: { Authorization: `Bearer ${process.env.FELAGAR_API_KEY}` },
})
const { data } = await res.json()

import os, requests
r = requests.get(
f"{os.environ['API']}/v1/projects",
headers={"Authorization": f"Bearer {os.environ['FELAGAR_API_KEY']}"},
)
print(r.json())

OAuth (apps & MCP)

Interactive apps use the OAuth authorization code + PKCE flow (same stack as MCP). Register an app under Settings → API keys, then:

1. Redirect users to the authorize URL on your MCP/OAuth host
2. Exchange the code at the token endpoint
3. Call /v1/* with Authorization: Bearer <access_token>

Default MCP scopes: tickets, projects, designs, time. Agency developer apps can request broader scopes. Tool calls are scope-checked and can appear in the agent action audit.

WebSocket tickets

Realtime chat and presence use the API WebSocket at /ws. Exchange a short-lived ticket first:

POST /v1/auth/ws-ticket (session or Bearer auth) → connect with the ticket query param.