Authentication

Base URLs

Bearer token (recommended)

Pass a JSON Web Token issued by GoOmni's identity provider (NextAuth / Amazon Cognito) in the Authorization header on every request:

curl https://agent.goomni.ai/api/pm/stories \
  -H "Authorization: Bearer <your-jwt>" \
  -H "Content-Type: application/json"

This is the bearerAuth scheme declared in the OpenAPI spec, so it works out of the box in Scalar, Postman, and generated SDKs.

Session cookie (browser & evaluation)

For browser apps and quick evaluation you can authenticate with a NextAuth session. Fetch a CSRF token, then sign in. The session cookie is sent automatically on subsequent requests.

# 1. Get a CSRF token
CSRF=$(curl -s -c cookies.txt https://agent.goomni.ai/api/auth/csrf \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['csrfToken'])")

# 2. Sign in (saves the session to cookies.txt)
curl -s -b cookies.txt -c cookies.txt \
  -X POST https://agent.goomni.ai/api/auth/callback/credentials \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "csrfToken=$CSRF&email=you@example.com&password=••••••" \
  -o /dev/null -w "Auth status: %{http_code}\n"

# 3. Call the API with the session cookie
curl -s -b cookies.txt https://agent.goomni.ai/api/pm/stories

Organization scoping

Every resource belongs to an organization (the top-level tenant), and most resources live under a project within it. Many endpoints therefore require an organizationId and/or projectId in the path, query, or body. Tokens only grant access to organizations the caller is a member of.

Unauthorized requests

Missing or invalid credentials return 401; a valid identity without access to the requested organization returns 403. Both use the standard error shape; see Errors.