SITEMAP / DOCS / API REFERENCE

Authentication

Waypath supports dashboard JWTs, legacy dashboard API keys, and agent-facing wp_live_... keys.

External agents should use wp_live_... keys and the capability gateway:

/api/v1/capabilities

Dashboard and internal UI routes may continue to use JWTs.

01JWT authentication

Register

POST /api/auth/register
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "your-password",
  "name": "Your Name"
}

Returns a JWT token with a 7-day expiry and creates a workspace for the user.

Login

POST /api/auth/login
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "your-password"
}

Verify session

GET /api/auth/session
Authorization: Bearer <jwt-token>

02Agent key authentication

Agent keys use the wp_live_ prefix. They are workspace-bound and can include legacy scopes, capability grants, allowed modes, auto_run, rate limits, and monthly quota overrides.

Send an agent key as either:

Authorization: Bearer wp_live_...

or:

X-API-Key: wp_live_...

Both forms work on API, CLI, and MCP-backed capability calls.

03Issue an agent key

Agent key management is dashboard/JWT-only. Agent keys cannot mint, list, or revoke other agent keys.

POST /api/v1/keys
Authorization: Bearer <jwt-token>
Content-Type: application/json

{
  "name": "Cursor Agent",
  "agent": "cursor",
  "scopes": ["v1:context:read", "v1:capabilities:invoke"],
  "grants": ["capability:context.get", "capability:memory.write"],
  "allowed_modes": ["dry_run", "execute"],
  "auto_run": false,
  "rate_limit_per_min": 300,
  "quota_override_monthly": 250
}

The response includes the plaintext key once. Store it securely.

04List agent keys

GET /api/v1/keys
Authorization: Bearer <jwt-token>

Returns key metadata only, including grants, allowed modes, quota override, last used time, and revoked state.

05Revoke an agent key

DELETE /api/v1/keys/:id
Authorization: Bearer <jwt-token>

Revocation is immediate across API, CLI, and MCP.

06Resolve the active agent key

GET /api/v1/keys/whoami
Authorization: Bearer wp_live_...

or:

GET /api/v1/keys/whoami
X-API-Key: wp_live_...

Returns workspace id, key id, agent label, scopes, grants, allowed modes, auto_run, quota override, last used time, and rate-limit headers.

07Legacy dashboard API keys

Older dashboard API keys use the dsk_ prefix and can still be sent with X-API-Key on legacy routes that support them. New external agent integrations should use wp_live_... keys and the capability gateway instead.

08Auth resolution

The server resolves authentication in this order:

  1. Authorization: Bearer wp_live_...
  2. Authorization: Bearer <jwt-token>
  3. X-API-Key: wp_live_...
  4. X-API-Key: dsk_...

If no valid credential is present, the server returns 401.