Spec auth/login for easystitch-service calls from ThreadCraft #12

New issue

Closed

opened 2026-06-25 03:11:37 +00:00 by Mark · 0 comments

Mark commented

2026-06-25 03:11:37 +00:00

Owner

ThreadCraft currently calls the service anonymously. Before this app leaves localhost we need an auth contract.

Open questions:

Token-in-header (Bearer) vs cookie-session?
Where does the token come from at dev time vs prod?
Per-user accounts or single shared service key for the household?
Login UI in ThreadCraft or just config in .env?

Acceptance: a written contract (or an endpoint in easystitch-service that issues tokens) and ThreadCraft sends the right header on every request.

ThreadCraft currently calls the service anonymously. Before this app leaves localhost we need an auth contract. Open questions: - Token-in-header (Bearer) vs cookie-session? - Where does the token come from at dev time vs prod? - Per-user accounts or single shared service key for the household? - Login UI in ThreadCraft or just config in .env? Acceptance: a written contract (or an endpoint in easystitch-service that issues tokens) and ThreadCraft sends the right header on every request.