bkend-auth

# bkend.ai Authentication & Security Guide ## Auth Methods | Method | Description | |--------|-------------| | Email + Password | Email/password signup and login | | Social (Google) | OAuth 2.0 social login | | Social (GitHub) | OAuth 2.0 social login | | Magic Link | Email link login (no password) | ## JWT Token Structure - **Access Token**: 1 hour validity - **Refresh Token**: 7 days validity - Auto-refresh: `POST /v1/auth/refresh` ## Password Policy 8+ characters, uppercase + lowercase + numbers + special characters ## MCP Auth Workflow bkend MCP does NOT have dedicated auth tools. Use this workflow: 1. **Search docs**: `search_docs` with query "email signup" or "social login" 2. **Get examples**: `search_docs` with query "auth code examples" 3. **Generate code**: AI generates REST API code based on search results ### Searchable Auth Docs | Doc ID | Content | |--------|---------| | `3_howto_implement_auth` | Signup, login, token management guide | | `6_code_examples_auth` | Email, social, magic link code examples | ### Key Pattern ``` User: "Add social login" → search_docs(query: "social login implementation") → Returns auth guide with REST API patterns → AI generates social login code ``` ## REST Auth API (Core Endpoints) For the complete endpoint list, use `search_docs` or check Live Reference. | Method | Endpoint | Description | |--------|----------|-------------| | POST | /v1/auth/email/signup | Sign up | | POST | /v1/auth/email/signin | Sign in | | GET | /v1/auth/me | Current user | | POST | /v1/auth/refresh | Refresh token | | POST | /v1/auth/signout | Sign out | | GET/POST | /v1/auth/:provider/callback | Social login callback | | POST | /v1/auth/password/reset/request | Password reset | | POST | /v1/auth/password/reset/confirm | Confirm reset | | POST | /v1/auth/password/change | Change password | | GET | /v1/auth/sessions | List sessions | | DELETE | /v1/auth/sessions/:sessionId | Remove session | | DELETE | /v1/auth/withdraw | Delete account | **Additional endpoints** (MFA, invitations, user management): use `search_docs` or Live Reference. ## RBAC (Role-Based Access Control) | Group | Description | Scope | |-------|-------------|-------| | admin | Full CRUD | All data | | user | Authenticated user | Full read, own write | | self | Owner only | createdBy-based | | guest | Unauthenticated | Read only (usually) | ## RLS (Row Level Security) - Per-table row-level access control - 4-level policies: admin/user/self/guest - Auto-filtering based on createdBy field ## Session Management - Per-device session tracking - `GET /v1/auth/sessions` - List sessions - `DELETE /v1/auth/sessions/:sessionId` - Remove session ## Official Documentation (Live Reference) For the latest authentication documentation, use WebFetch: - Auth Overview: https://raw.githubusercontent.com/popup-studio-ai/bkend-docs/main/en/authentication/01-overview.md - MCP Auth Guide: https://raw.githubusercontent.com/popup-studio-ai/bkend-docs/main/en/mcp/06-auth-tools.md - Security: https://raw.githubusercontent.com/popup-studio-ai/bkend-docs/main/en/security/01-overview.md - Full TOC: https://raw.githubusercontent.com/popup-studio-ai/bkend-docs/main/SUMMARY.md