Auth & account

GET /auth/status 🌐

Indicates whether initial setup is required and whether a session exists.

{ "setup_required": false, "user": { "id": 1, "username": "admin" } }

As long as setup is pending (setup_required: true), the response additionally contains demo_available – whether this binary has an embedded demo website that POST /auth/setup with "demo": true can import (release builds always, self-built ones only after scripts/build-demo.sh):

{ "setup_required": true, "demo_available": true, "user": null }

user is null if no valid session cookie was sent (API tokens don’t count here). In remote mode, the response additionally contains remote (the selected connection).

POST /auth/setup 🌐

Creates the first admin and starts a session right away. Only works as long as no user exists yet, 409 afterwards.

{ "username": "admin", "password": "mindestens-8-zeichen" }

Response 200: { "user": { "id": 1, "username": "admin" } } + Set-Cookie: ic_session=…

Validation: username 1–64 characters, password at least 8 characters. At most 72 bytes (auth.passwordTooLong). If IC_SETUP_TOKEN is set on the server, setup additionally requires "setup_token" in the body (or header X-IC-Setup-Token), otherwise 403 setup.tokenInvalid; GET /auth/status then reports setup_token_required: true. After changing your own password (POST /auth/password, also PUT /users/{id}/password on your own account) all other sessions of the account end; wrong attempts count towards the limit (429 auth.tooManyAttempts), and login additionally counts per username (30 attempts / 15 min).

Demo website (optional, only here – there is no way via this endpoint afterwards): With "demo": true, the server imports the embedded demo after creating the account – like a bundle import including media and the entries of live Collections, without a backup (the instance is empty). REST sources whose URL starts with http://demo.invalid then point to the address of the request (scheme and host, behind a proxy via X-Forwarded-Proto/-Host).

{ "username": "admin", "password": "mindestens-8-zeichen", "demo": true }

Response 200: { "user": {…}, "demo": { "pages": 23, "files": 12, "sources": 1 } } + Set-Cookie. Errors: 400 setup.demoUnavailable (this binary contains no demo – no account is created), 500 setup.demoFailed (the account is created and logged in, only the demo is missing; params.error gives the reason).

POST /auth/login 🌐

{ "username": "admin", "password": "…" }

• 200 { "user": {…} } + session cookie
• 401 invalid username or password
• 429 after 10 failed attempts per IP within 15 minutes

POST /auth/logout 🌐

Ends the current session and deletes the cookie. Response: { "ok": true }.

POST /auth/password 👤

{ "current": "altes-passwort", "new": "neues-passwort" }

• 200 { "ok": true }
• 403 current password is wrong
• 400 new password shorter than 8 characters

---