Developer
Authentication
Login, registration, and session flows for API consumers.
Browser applications
The web app uses HttpOnly session cookies after POST /auth/login. Do not
store bearer tokens in browser storage.
Machine integrations
For server-to-server work:
- Use documented
/auth/*endpoints in the API reference - Respect MFA and portal membership responses (
nextStepcontinuation) - Send
X-Portalon subsequent portal calls
Public routes
Routes under /public/ (countries, contact, platform catalogs) do not require a
session. They are listed in the public OpenAPI artifact.
User onboarding docs
End-user steps: First login
Feature coverage
No registry features are linked to this hub.