Authentication

Keep integration keys on your server.Run privileged requests in trusted server code. Do not bundle a long-lived API key in a public frontend. Browser examples illustrate request structure only.

OwnMediaHost supports two authentication methods:

1. API Key (Recommended for integrations)

Pass your API key in the X-API-Key request header:

bash

curl -H "X-API-Key: YOUR_API_KEY" \
  https://api.example.com/api/v1/files

Generate API keys from the API Keys page in the dashboard. Each key can be scoped with specific permissions:

Permission	Description
`files.read`	List and download files
`files.write`	Upload, update, and delete files
`folders.read`	List folders
`folders.write`	Create, update, and delete folders
`aliases.read`	List vanity aliases
`aliases.write`	Create and delete aliases
`keys.read`	List API keys
`keys.write`	Create and revoke API keys
`settings.read`	Read platform settings
`settings.write`	Modify platform settings

For the web dashboard, authenticate via email/password login:

bash

curl -X POST https://api.example.com/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]", "password": "yourpassword"}'

Response:

json

{
  "success": true,
  "data": {
    "user": { "id": "usr_abc", "email": "[email protected]" },
    "token": "eyJhbGciOiJIUzI1NiIs..."
  }
}

Use the returned token in subsequent requests:

bash

curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  https://api.example.com/api/v1/files

1. API Key (Recommended for integrations)

2. Session Token (Dashboard login)