Authentication
Auva supports email/password, OAuth (GitHub, Discord, X), TOTP 2FA, and passkeys.
JWT sessions
| Token | Lifetime | Transport |
|---|---|---|
| Access | 15 minutes | Authorization header |
| Refresh | 30 days | httpOnly cookie |
Sign in
POST /api/auth/login
Content-Type: application/json
{ "email": "you@example.com", "password": "..." }
If 2FA is enabled, the response includes requires2FA: true and a pendingToken. Complete login via POST /api/auth/2fa/complete-login.
Refresh
POST /api/auth/refresh
Uses the refresh cookie; returns a new access token.
API keys
Create keys in the account dashboard. Pass as:
Authorization: Bearer auva_...
Keys inherit the user's permissions but cannot access admin endpoints unless the user has the platform admin role.
Platform admin role
Admin access is stored on the user record as platformRole: "admin". Admins can promote or demote other admins via the admin dashboard - not via environment variables.