Authentication & API keys

Magnum separates human accounts, backend credentials, and temporary checkout capabilities. Each account has one business; resource authorization is enforced against that business on the server.

Backend API keys

Send Authorization: Bearer mg_… to integration routes. Each key belongs to one workspace and has scopes, expiration, and revocation. Only a cryptographic digest with a separate server secret is stored. The full key is shown once at creation.

Secret-key requests containing an Origin header are rejected: call from your server, not a browser. Local bootstrap keys expire after 30 days; the account API supports 1–365 days.

Checkout capabilities

Browsers use Authorization: Checkout <token>. This token can only operate its matching session within stored restrictions and expiration. It cannot create integrations or access another workspace.

Rotation and revocation

Create a replacement, update your backend, and revoke the previous key through the account API. Store secrets in private Coolify variables. Revocation is checked on every request.

The global 4P Finance credential is managed exclusively by the Magnum operator in the private backend environment. It is separate from business-scoped Magnum API keys and is never returned to integrators or browsers. A business configures receiving destinations, not provider secrets.

Google sign-in

Google OAuth is optional and uses the existing Better Auth session. Configure GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET together on the API, and register https://magnum.lat/api/auth/callback/google as an authorized redirect URI. The Google option is visible on the sign-in and sign-up screens. Until both credentials are configured it reports that access is unavailable and does not start OAuth; no secret is sent to the browser. Requested scopes are limited to identity, profile and email. New-account registration remains subject to AUTH_ALLOW_SIGNUP, verified email is required, and OAuth tokens are encrypted at rest. Callback URLs must stay on the application origin.

Transactional email setup

For Resend, configure RESEND_API_KEY and RESEND_FROM on the API and worker; the sender domain must be verified in that Resend account. MAIL_FROM is the fallback sender when RESEND_FROM is blank. Legacy SMTP uses SMTP_URL and MAIL_FROM. Keep credentials out of the browser and enable AUTH_ALLOW_SIGNUP=true only after validating an authorized real delivery.

Templates cover verification, password recovery, welcome after verification and password-change notices in both languages. Links use the exact APP_URL, such as https://magnum.lat. A successful verification authenticates the account; failed or expired tokens do not. Password recovery is single-use and revokes existing sessions.

Resend retries reuse a stable idempotency key and unchanged payload. Jobs never switch provider automatically, and changing the credential stops existing jobs for review. Provider accepted status is distinct from delivered, read or verified; delivery/bounce webhooks are not implemented. Generic SMTP outcomes that may already have been accepted require operator review.