3x-ui-agent/docs/content/docs/zh/reference/api/authentication.mdx

---
title: 身份验证
description: >-
  支持两种身份验证模式。UI 会话使用登录端点设置的 Cookie。程序化客户端（机器人、脚本、远程面板）则使用从“设置 →
  安全 → API Token”获取的 Bearer token 进行身份验证。两者都适用于 /panel/api/* 下的所有端点。
full: true
_openapi:
  preload:
    - ./public/openapi.json
  toc:
    - depth: 2
      title: >-
        Authenticate with username + password and receive a session cookie.
        Required before any cookie-based API call.
      url: >-
        #authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
    - depth: 2
      title: Clear the session cookie. Requires the CSRF header for browser sessions.
      url: '#clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions'
    - depth: 2
      title: >-
        Mint a CSRF token for the current session. The SPA replays it in the
        X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
        this — the middleware short-circuits CSRF for authenticated API
        requests.
      url: >-
        #mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
    - depth: 2
      title: >-
        Returns whether 2FA is enabled on the panel — used by the login page to
        decide whether to show the OTP field.
      url: >-
        #returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
  structuredData:
    headings:
      - content: >-
          Authenticate with username + password and receive a session cookie.
          Required before any cookie-based API call.
        id: >-
          authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
      - content: >-
          Clear the session cookie. Requires the CSRF header for browser
          sessions.
        id: clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions
      - content: >-
          Mint a CSRF token for the current session. The SPA replays it in the
          X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
          this — the middleware short-circuits CSRF for authenticated API
          requests.
        id: >-
          mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
      - content: >-
          Returns whether 2FA is enabled on the panel — used by the login page
          to decide whether to show the OTP field.
        id: >-
          returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
    contents: []
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

export default function Layout(props) {
  const { APIPage, OpenAPIPage } = props.components ?? {};
  // "APIPage" is the old name from v10, this allows both for backward compatibility
  const Comp = OpenAPIPage ?? APIPage;
  return (
    <>
      {props.children}
      <Comp document="./public/openapi.json" webhooks={[]} operations={[{"path":"/login","method":"post"},{"path":"/logout","method":"post"},{"path":"/csrf-token","method":"get"}]} showTitle />
    </>
  );
}