Skip to main content

​
Authentication

​
Session-Based (Browser)

Sontairo uses NextAuth.js for session-based authentication. When accessing the API from the browser, authentication is handled automatically via session cookies.

​
Supported Auth Providers

  • Email/Password — Traditional email and password login
  • Google — OAuth via Google
  • GitHub — OAuth via GitHub

​
Workspace Membership

All API routes verify that the authenticated user is a member of the target workspace. Requests to workspaces the user doesn’t belong to return 403 Forbidden.

​
Rate Limiting

API requests are subject to rate limiting. If you exceed the limit, you’ll receive a 429 Too Many Requests response.