Authentication
Two credential types
Section titled “Two credential types”| Credential | For | How it is sent |
|---|---|---|
| Session | The panel UI, browser flows | Cookie set at login |
| API key | Scripts, bots, integrations | Authorization: Bearer <key> header |
Use API keys for anything programmatic. Do not automate logins or scrape session cookies — sessions expire, rotate, and are tied to browser behavior.
Create an API key
Section titled “Create an API key”Administrators create keys under Admin → API Keys (or POST /api/admin/api-keys). Each key carries scoped permissions from the permissions
catalog — grant only what the integration needs:
curl -H "Authorization: Bearer $CATALYST_API_KEY" \ https://panel.example.com/api/serversKey hygiene
Section titled “Key hygiene”- Store keys in a secret manager or environment variable, never in git.
- One key per integration, named for its purpose — when a key leaks you revoke one integration, not everything.
- Rotate on suspicion and on staff changes. Deleting a key revokes it immediately.
- Scope read-only where possible: a status dashboard does not need power controls.
Node authentication (reference)
Section titled “Node authentication (reference)”Nodes authenticate to the panel with a separate node ID + API key pair over server-to-server channels. Those credentials are managed through node registration (registering a node) and are never valid for the user-facing API, and vice versa.