3x-ui-agent/docs/content/docs/en/reference/api/authentication.mdx

---
title: Authentication
description: Two authentication modes are supported. UI sessions use a cookie
  set by the login endpoint. Programmatic clients (bots, scripts, remote panels)
  authenticate with a Bearer token taken from Settings → Security → API Token.
  Both work for every endpoint under /panel/api/*.
full: true
_openapi:
  preload:
    - ./public/openapi.json
  toc:
    - depth: 2
      title: Authenticate with username + password and receive a session cookie.
        Required before any cookie-based API call.
      url: '#authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call'
    - depth: 2
      title: Clear the session cookie. Requires the CSRF header for browser sessions.
      url: '#clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions'
    - depth: 2
      title: Mint a CSRF token for the current session. The SPA replays it in the
        X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
        this — the middleware short-circuits CSRF for authenticated API
        requests.
      url: '#mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests'
    - depth: 2
      title: Returns whether 2FA is enabled on the panel — used by the login page to
        decide whether to show the OTP field.
      url: '#returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field'
  structuredData:
    headings:
      - content: Authenticate with username + password and receive a session cookie.
          Required before any cookie-based API call.
        id: authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
      - content: Clear the session cookie. Requires the CSRF header for browser
          sessions.
        id: clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions
      - content: Mint a CSRF token for the current session. The SPA replays it in the
          X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
          this — the middleware short-circuits CSRF for authenticated API
          requests.
        id: mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
      - content: Returns whether 2FA is enabled on the panel — used by the login page to
          decide whether to show the OTP field.
        id: returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
    contents: []
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

export default function Layout(props) {
  const { APIPage, OpenAPIPage } = props.components ?? {};
  // "APIPage" is the old name from v10, this allows both for backward compatibility
  const Comp = OpenAPIPage ?? APIPage;
  return (
    <>
      {props.children}
      <Comp document="./public/openapi.json" webhooks={[]} operations={[{"path":"/login","method":"post"},{"path":"/logout","method":"post"},{"path":"/csrf-token","method":"get"}]} showTitle />
    </>
  );
}