Authentication

Before you can use the API, you need to log in with your admin account. The login endpoint returns a session token that you include in all subsequent requests.

Log in

curl -s -X POST http://your-server/api/login \
  -H "Content-Type: application/json" \
  -d '{"user": "admin@fablab.org", "pass": "your-password"}'

The server responds with a token:

{"token": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"}

For convenience, you can store the token in a shell variable:

TOKEN=$(curl -s -X POST http://your-server/api/login \
  -H "Content-Type: application/json" \
  -d '{"user": "admin@fablab.org", "pass": "your-password"}' | jq -r '.token')

Providing the token

Include the token in every request. The server accepts it in three places (checked in this order):

1. Authorization header (recommended):

   Authorization: Bearer $TOKEN
   

2. Session cookie (set automatically after login if you preserve cookies)
3. Query parameter (fallback):

   ?token=$TOKEN
   

Already logged in

If the session cookie already contains a valid token, a second login request returns the existing token without creating a new session.

Log out

When you are done, invalidate the session:

curl -X POST http://your-server/api/logout \
  -H "Authorization: Bearer $TOKEN"

Response:

{"success": true}

Error responses

API tokens

For automated or long-running integrations you can create API tokens instead of using session-based login. API tokens are managed through the admin UI and can be used directly as bearer tokens — no login step required.

Creating an API token

1. Open the Admin panel in the 2log UI.
2. Navigate to the API Tokens section.
3. Provide a name, an optional description, permissions, and an optional expiration date.
4. Click Create. The token string is shown once — copy and store it securely.

Using an API token

Use the token exactly like a session token. The server accepts it in the same three places:

# Authorization header (recommended)
curl http://your-server/api/some-endpoint \
  -H "Authorization: Bearer <API_TOKEN>"

# Query parameter
curl "http://your-server/api/some-endpoint?token=<API_TOKEN>"

Key differences from session tokens