omni-auth

<!-- generated by src/lib/agentSkills/generator.ts; manual edits will be overwritten --> ## Overview Manage API key authentication and session tokens. Start here to authenticate requests via Bearer token, obtain session cookies, and configure login requirements for the OmniRoute API. ## Authentication Remote API requests use a Bearer credential. Dashboard login is different: `POST /api/auth/login` accepts a management password and returns an `auth_token` session cookie. ## Endpoints ### POST /api/auth/login Authenticate user ```bash curl -X POST https://localhost:20128/api/auth/login \ -H "Content-Type: application/json" \ -c cookie.jar \ -d '{"password":"<management-password>"}' ``` ### POST /api/auth/logout Log out ```bash CSRF_TOKEN=$(curl -s https://localhost:20128/api/auth/csrf -b cookie.jar | jq -r .token) curl -X POST https://localhost:20128/api/auth/logout \ -b cookie.jar \ -H "x-omniroute-csrf: $CSRF_TOKEN" \ -H "Content-Type: application/json" \ -d '{}' ``` ### GET /api/auth/oidc/login Start OIDC login for the dashboard admin gate Builds an authorization URL from the configured OIDC issuer/client (discovered via `{issuer}/.well-known/openid-configuration`, falling back to `{issuer}/authorize`), sets a short-lived `oidc_state` cookie, and redirects the browser. Password login remains available as a fallback while OIDC is enabled. ```bash curl https://localhost:20128/api/auth/oidc/login \ -b cookie.jar ``` ### GET /api/auth/oidc/callba...