Authentication

CloudPulse uses one identity model for the web app and the REST API.

Browser (SPA)

Login: POST /v1/auth/login with email + password (or SSO).
Session cookie: httpOnly cloudpulse_session on the app host.
SPA calls go to https://app.cloudpulse.host/api/v1/… with credentials: "include".
Logout: POST /v1/auth/logout.
Bootstrap: GET /v1/auth/me (includes role, scope, tenant, granted account ids).

Scripts & integrations (Bearer)

Use the product API host. Login returns a JWT; send it on every request:

POST https://api.cloudpulse.host/v1/auth/login
Content-Type: application/json

{ "email": "you@example.com", "password": "…" }

Authorization: Bearer <token>
GET https://api.cloudpulse.host/v1/auth/me

If both a cookie and Authorization are present, the Bearer token wins.

SSO (OIDC)

Tenant admins configure OIDC under Settings → Tenants & SSO.
Login entry: GET /v1/auth/oidc/login?tenant=<slug>.
Callback stays on the app origin so the session cookie can be set.
When sso_required is on, password login is rejected for that tenant.

MFA

Users with MFA enabled complete POST /v1/auth/mfa/verify after password login before a full session is issued. Setup / enable / disable require an active session (and password when the account has one).

Session policy

Idle timeout (default 45 minutes; sliding via POST /v1/auth/refresh).
Absolute token TTL (default 24 hours).
Role, scope, tenant, and active flag are reloaded from the database on every request — demotions take effect immediately.

Roles & scopes

See Roles & scopes for capability details. In short:

Roles: admin, editor, analyst, finops, viewer.
Scopes: tenant for your organization (provider is CloudPulse staff only).