Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
How JWT and API keys work in the NekoHub API.
Authorization: Bearer <access_token>
curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
http://localhost:5121/api/v1/assets
POST /api/v1/auth/logoutGET /api/v1/auth/meAuthorization header. Do not use the legacy custom header form:
Authorization: Bearer <api_key>
curl -H "Authorization: Bearer your-api-key" \
http://localhost:5121/api/v1/assets
Auth__ApiKey__Enabled=true
Auth__ApiKey__Keys__0=your-strong-random-key
/mcp only accepts API keys.
| Endpoint group | JWT | API key |
|---|---|---|
| Public assets | Not required | Not required |
/content/{storageKey} | Not required | Not required |
GET /api/v1/system/ping | Not required | Not required |
GET /api/v1/system/bootstrap | Not required | Not required |
POST /api/v1/auth/login | Not required | Not required |
POST /api/v1/auth/refresh | Not required | Not required |
POST /api/v1/auth/logout | Required | Not accepted |
GET /api/v1/auth/me | Required | Not accepted |
/api/v1/assets | Accepted | Accepted |
/api/v1/users | Accepted | Accepted |
/api/v1/system/storage | Accepted | Accepted |
/api/v1/system/ai/providers | Accepted | Accepted |
/mcp | Not accepted | Required |
| HTTP status | Error code | Meaning |
|---|---|---|
401 Unauthorized | auth_unauthorized | Missing or invalid JWT |
401 Unauthorized | api_key_missing | API key was not provided |
401 Unauthorized | api_key_invalid | API key is invalid or the header format is wrong |
401 Unauthorized | auth_token_expired | JWT expired |
403 Forbidden | auth_forbidden | Authenticated but not authorized |
Was this page helpful?