Sign in

jichu has no password and no login endpoint: a credential is a token. Paste one here.

• A session token signs in directly. It can read everything and write only the enumerated set: the app's name, and secrets.
• An admin token — the one jichu token bootstrap --email you@example.com prints once — signs in by minting a session token, and it is that session token the server keeps, never the admin one.

The browser keeps an opaque session id in an HttpOnly cookie; the platform token stays in this server's memory and is dropped when the process restarts. Signing out clears the cookie and forgets the session, but does not revoke the token: that is DELETE /v1/auth/tokens/{id} with an admin token.