Authentication

The API uses the same sign-in as the app: a session cookie.

Sign in

POST /service/auth/credentials
Content-Type: application/json

{ "UserName": "jsmith", "Password": "…", "RememberMe": false }

A successful response sets the session cookies (ss-id and ss-pid). Send them with each later request. Use a cookie jar in your HTTP client.

Sign out

POST /service/auth/logout

Single sign-on

People who sign in with Microsoft Entra ID or Google do so in a browser. Integrations should use their own MaxTrax account. See Single sign-on for how the site is set up.

Good practice

• Give an integration its own MaxTrax user with the lowest role and fewest projects that do the job.
• Keep its password in a secrets store, never in code or logs.
• Expect a 401 when the session ends, and sign in again.