3x-ui/docs/content/docs/en/reference/api/authentication.mdx

---
title: Authentication
description: Two authentication modes are supported. UI sessions use a cookie
  set by the login endpoint. Programmatic clients (bots, scripts, remote panels)
  authenticate with a Bearer token taken from Settings → Security → API Token.
  Both work for every endpoint under /panel/api/*.
full: true
_openapi:
  preload:
    - ./public/openapi.json
  toc:
    - depth: 2
      title: Authenticate with username + password and receive a session cookie.
        Required before any cookie-based API call.
      url: '#authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call'
    - depth: 2
      title: Clear the session cookie. Requires the CSRF header for browser sessions.
      url: '#clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions'
    - depth: 2
      title: Mint a CSRF token for the current session. The SPA replays it in the
        X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
        this — the middleware short-circuits CSRF for authenticated API
        requests.
      url: '#mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests'
    - depth: 2
      title: Public. Active paid sponsor placements read from the project
        sponsors.json (cached for 1h); entries outside their from/until window
        are dropped. Logos are proxied by the panel at /sponsors/logo/{name}.
        Used by the login page and panel sponsor slots.
      url: '#public-active-paid-sponsor-placements-read-from-the-project-sponsorsjson-cached-for-1h-entries-outside-their-fromuntil-window-are-dropped-logos-are-proxied-by-the-panel-at-sponsorslogoname-used-by-the-login-page-and-panel-sponsor-slots'
    - depth: 2
      title: Returns whether 2FA is enabled on the panel — used by the login page to
        decide whether to show the OTP field.
      url: '#returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field'
  structuredData:
    headings:
      - content: Authenticate with username + password and receive a session cookie.
          Required before any cookie-based API call.
        id: authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
      - content: Clear the session cookie. Requires the CSRF header for browser
          sessions.
        id: clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions
      - content: Mint a CSRF token for the current session. The SPA replays it in the
          X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
          this — the middleware short-circuits CSRF for authenticated API
          requests.
        id: mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
      - content: Public. Active paid sponsor placements read from the project
          sponsors.json (cached for 1h); entries outside their from/until window
          are dropped. Logos are proxied by the panel at /sponsors/logo/{name}.
          Used by the login page and panel sponsor slots.
        id: public-active-paid-sponsor-placements-read-from-the-project-sponsorsjson-cached-for-1h-entries-outside-their-fromuntil-window-are-dropped-logos-are-proxied-by-the-panel-at-sponsorslogoname-used-by-the-login-page-and-panel-sponsor-slots
      - content: Returns whether 2FA is enabled on the panel — used by the login page to
          decide whether to show the OTP field.
        id: returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
    contents: []
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

export default function Layout(props) {
  const { APIPage, OpenAPIPage } = props.components ?? {};
  // "APIPage" is the old name from v10, this allows both for backward compatibility
  const Comp = OpenAPIPage ?? APIPage;
  return (
    <>
      {props.children}
      <Comp document="./public/openapi.json" webhooks={[]} operations={[{"path":"/login","method":"post"},{"path":"/logout","method":"post"},{"path":"/csrf-token","method":"get"},{"path":"/sponsors","method":"get"},{"path":"/getTwoFactorEnable","method":"post"}]} showTitle />
    </>
  );
}