Implementation: How should the API explorer authenticate users in the browse...

Documentation for Sessions

⚙️ Implementation: How should the API explorer authenticate users in the browse...

Date: 2026-02-09
Time: 20:15:25 UTC
Session: gspace1-101.8
Agent: angular
Confidence: 95%
Status: ✅ Documented

📋 Decision Context

Question:

How should the API explorer authenticate users in the browser UX?

Task: Not specified

🎯 Decision Made

Chosen:

Tabbed login UI: Login tab (email/password → /api/auth/login → JWT) as default, Token tab (paste JWT/system token) as fallback

Options Considered:

Only paste-token field (previous)
Tabbed Login + Token tabs
OAuth popup flow like VSCode extension
Redirect to separate login page

💭 Reasoning

Login form is the simplest one-click flow for the common case. Same-origin fetch to /api/auth/login returns accessToken, which is used to call /api/system/explorer. No redirects, no popups, no CORS. Token tab kept as fallback for system tokens and automation. sessionStorage persists per tab. OAuth popup would be over-engineered for a server-rendered ops page.

📁 Files Involved

libs/libs-api/backend-core/src/lib/utils/service-identity/html-renderers.ts
libs/libs-api/backend-core/src/lib/utils/service-identity/html-css.ts
libs/libs-api/backend-core/src/lib/utils/service-identity/types.ts

🔗 Related

Decision ID: dev_1770668125301_2ycm308
Session: 101
Workspace: gspace1

Auto-generated by MCP Smart Consolidation