Session and logout

Send the credential on protected routes

Protected routes accept the token in the Authorization header or the session cookie issued at login.

export ACCESS_TOKEN='<access_token received>'

curl -i \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "$API_BASE/download/list"

# cookies.txt was saved at login with curl -c cookies.txt
curl -i -b cookies.txt "$API_BASE/download/list"

If you send the Authorization header and the __Host-dirl_session cookie together, the header takes precedence.

Expiration

The session is no longer accepted when the token expires, according to the policy configured in the environment. For OAuth tokens, expires_in gives the validity in seconds.

When a protected route responds 401, obtain a new credential (new login or new token) and retry the call.

End the session

Use GET or POST /auth/logout and send the same credential you use on protected routes. When applicable, the API clears the session cookie.

curl -i -X POST \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "$API_BASE/auth/logout"

curl -i -X POST -b cookies.txt -c cookies.txt \
  "$API_BASE/auth/logout"

For sessions opened through SSO, use federated logout.