Audience: Developers, Admins
Outcomes: You can authenticate, keep a session cookie, and call any API
Base URL
https://api.your-tradeos-domain.com
Authenticate (login → session cookie)
curl -X POST $API_BASE/api/auth/login \ -H 'Content-Type: application/json' \ -d '{"email":"[email protected]","password":"••••••"}' \ -c cookies.txtWe set a secure, httpOnly cookie (
connect.sid).Include it on subsequent calls with
-b cookies.txt.
Example: session check
curl -X GET $API_BASE/api/auth/session -b cookies.txt # → {"userId":42,"orgId":"org_123","role":"admin","kycStatus":"verified"}
Session lifetime
Sliding TTL on activity + absolute max age (requires re‑login after a long time).
Cookies are secure in production and SameSite=lax.
Security headers & CORS (quick view)
CORS allow‑list must include only your frontend domains.
CSP restricts scripts/frames to approved providers (e.g., Stripe).