Skip to content
Legaciti Dev Docs

Authentication

Authentication models used by the dashboard and public APIs.

Legaciti exposes two different HTTP API surfaces with different security models.

Dashboard API

Section titled “Dashboard API”

The dashboard API is protected by Better Auth session authentication.

  • Canonical browser origin: https://my.legaciti.org
  • Sign in: https://my.legaciti.org/login
  • Better Auth routes: https://my.legaciti.org/api/auth/*
  • Intended audience: internal dashboard users and administrative tooling

Supported login methods:

  • Email and password (with email verification)
  • Google OAuth

When an endpoint requires dashboard authentication, the generated reference marks it with Better Auth Session.

Session Cookies

Section titled “Session Cookies”

Better Auth issues secure HttpOnly session cookies on sign-in. The browser attaches the cookie automatically to all same-origin requests. Non-browser clients can pass the session token as a Bearer token in the Authorization header.

Authorization

Section titled “Authorization”

Authorization is DB-backed:

  • app_users.is_superadmin controls superadmin access to /admin/* and site-tools
  • workspace_memberships controls per-workspace access

Public API

Section titled “Public API”

The public API is mostly read-only, with scoped API-key write endpoints for trusted partner automation.

  • Primary domain: https://api.legaciti.org
  • Read endpoints are public
  • POST /api/ingest requires an API key with ingest scope
  • POST /api/partners/people/:orcid/membership requires an API key with membership.update scope

Public API keys are sent in the X-API-Key header and validated by the worker against hashed key records.

The generated reference marks public endpoints as Public and API-key protected operations as API key.

Notes

Section titled “Notes”
  • Internal operational endpoints are included in the dashboard reference but marked as internal when they are administrative in nature.
  • The docs site publishes raw OpenAPI JSON so downstream tooling can consume the same machine-readable schema.
Docs Architecture Runbooks Dashboard

Start Here

Legaciti Dev Docs Documentation Index Documentation Placement Guide New Contributors

Architecture

Repo Map Code Placement Guide Package Categories Dependency Rules Dashboard App Structure Worker Structure Known Architecture Gaps 07 — Feature Source of Truth 08 — Feature Module Internals 09 — TanStack Query Patterns 10 — Domain Packages 11) Cloudflare Runtime Boundary Generated Artifacts Policy 13 — Naming Conventions 14 — Barrel Files and Public Boundaries Architecture Checks in CI 16 — Contributing With The Architecture 17 — Feature Package Audit

Runbooks

GlitchTip Monitoring Setup Integrations API Rollout Runbook Slow DB Query Runbook Workspace Modules Rollout Runbook

Operational References

Worker Deploy Order Workspace API Key Management Publication & ORCID Resync Single-ORCID Resync Resync Unverified Works

Migrated Internal Docs

ADR E1: Localized Search Strategy ADR — Installation-Centric Integrations Model Authentication Operations CLI Deploy Workers Integrations Ownership, Migration, and Rollback Locale Key Checks Locale-Search Rollout Runbook Operations Runbook Partner Write API Performance And Localization Roadmap (2 to 100 Languages) Performance And Localization Implementation Backlog

Root Docs Archive

Fallow Prompt Documentation Placement Guide Documentation Index