Authentication
Session cookies for the dashboard API and hashed keys for the browser extension.
Session cookie
Demo and local auth set toksync_role=user|admin via GET /api/auth/session?role=user&next=/dashboard. Browser fetches to /api/products include this cookie automatically.
Server-to-server scripts must either use a cookie jar after hitting session, or call only key-authenticated routes. Do not send toksync_role as a forgeable header from untrusted clients in production — production should use real session issuance.
Roles
user— catalog, import, destinations, publish, billing, operator supportadmin— system queues, DLQ, analytics, traffic SSE
Middleware blocks the wrong shell. A user cookie cannot load /admin.
Extension API key
POST /api/extension/ingest requires x-toksync-api-key. Keys are hashed in user_api_keys. Generate in the dashboard, paste once into the extension, rotate on leak.
Session cookies are not a substitute on that route (extension origin ≠ dashboard origin).
Channel OAuth
Shopify, Amazon, TikTok Shop, eBay, Walmart use that marketplace’s OAuth. Tokens never appear in client-side JS after the callback; they are encrypted on destination_accounts. Revoke in the marketplace console **and** disconnect in Destinations.