Authorization

For integrations, send a user API key on every request using the Bearer scheme. Keys use the prefix fast_. The gateway resolves keys via SHA-256 hash; never log raw keys.

Creating keys

Open Profile → Integrations → API keys to create or revoke keys. The account must have API access enabled where policy requires it.

Bearer header

Authorization: Bearer fast_xxxxxxxxxxxx

Session ping

POST /auth/session/api-key with Authorization: Bearer fast_… and JSON body {} validates the key and returns identity for integrators.

Other auth routes

Password login (POST /auth/login/user) and registration (POST /auth/register/user) support the web app; they may not appear in the trimmed OpenAPI file. Unknown or non-public paths return 404 with structured errors.