# API Authentication

Authenticates API requests with bearer tokens and session cookies, and sets login rules.

- Repository: https://github.com/cheaper-inference/OmniRoute (83611 stars)
- Category: Security
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add cheaper-inference/OmniRoute --skill omni-auth -g -a claude-code -y`
Codex: `npx skills add cheaper-inference/OmniRoute --skill omni-auth -g -a codex -y`
Cursor: `npx skills add cheaper-inference/OmniRoute --skill omni-auth -g -a cursor -y`
Gemini CLI: `npx skills add cheaper-inference/OmniRoute --skill omni-auth -g -a gemini-cli -y`

## Description

Manage API key authentication and session tokens. Start here to authenticate requests via Bearer token, obtain session cookies, and configure login requirements for the OmniRoute API.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

<!-- generated by src/lib/agentSkills/generator.ts; manual edits will be overwritten -->

## Overview

Manage API key authentication and session tokens. Start here to authenticate requests via Bearer token, obtain session cookies, and configure login requirements for the OmniRoute API.

## Authentication

Remote API requests use a Bearer credential. Dashboard login is different: `POST /api/auth/login` accepts a management password and returns an `auth_token` session cookie.

## Endpoints

### POST /api/auth/login

Authenticate user

```bash
curl -X POST http://localhost:20128/api/auth/login \
  -H "Content-Type: application/json" \
  -c cookie.jar \
  -d '{"password":"<management-password>"}'
```

### POST /api/auth/logout

Log out

```bash
CSRF_TOKEN=$(curl -s http://localhost:20128/api/auth/csrf -b cookie.jar | jq -r .token)
curl -X POST http://localhost:20128/api/auth/logout \
  -b cookie.jar \
  -H "x-omniroute-csrf: $CSRF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/auth/oidc/login

Start OIDC login for the dashboard admin gate

Builds an authorization URL from the configured OIDC issuer/client (discovered
via `{issuer}/.well-known/openid-configuration`, falling back to `{issuer}/authorize`),
sets a short-lived `oidc_state` cookie, and redirects the browser. Password login
remains available as a fallback while OIDC is enabled.


```bash
curl http://localhost:20128/api/auth/oidc/login \
  -b cookie.jar
```

### GET /api/auth/oidc/callback

Complete OIDC login for the dashboard admin gate

The rest: https://github.com/cheaper-inference/OmniRoute/blob/HEAD/skills/omni-auth/SKILL.md