Aqua Auth Service

Proxy authentication API

The proxy signs in once, then checks the session on every start and every few minutes while it runs. subscription.launcher_allowed says whether the account may use the proxy right now.

POST

/api/login

Body { identifier, password, hwid } (identifier = username or email). Returns a bearer token valid for 30 days plus the full account. Signing in again from the same HWID revokes that machine's older token.

GET

/api/session

Account, subscription, wallet and session info. Needs Authorization: Bearer <token>; optional X-HWID.

POST

/api/logout

Revokes the token that made the call.

POST

/api/logout-all

Revokes every token of the account (all devices).

GET

/api/health

Uptime probe. No auth required.

Example

curl -X POST http://auth.aquaproxy.store/api/login \
  -H "Content-Type: application/json" \
  -d '{"identifier":"yourname","password":"secret","hwid":"0123abcd..."}'

# → { "ok": true, "token": "…", "user": {…}, "subscription": { "launcher_allowed": true, … },
#     "wallet": {…}, "session": {…}, "server": {…} }

curl http://auth.aquaproxy.store/api/session -H "Authorization: Bearer …"

# errors → { "ok": false, "error": "invalid_credentials", "message": "Wrong username or password." }

The client never holds a shared secret: the only credential it keeps is the member's own token.