Access control

Anyone on the wifi could otherwise spend your model credits and delete your boards. The rule is deliberately small.

{ width="640" }

The ruleCopy Anchor Link

1. Requests from the machine itself (loopback) are always allowed. Opening https://localhost:8443/ on the server needs nothing.
2. Every other client needs the access token, presented as:
   • the cookie set by /login;
   • Authorization: Bearer <token> — for scripts;
   • ?token=<token> once in any URL — it is exchanged for the cookie and removed from the address bar. This is what the QR code printed at startup carries, so a phone that scans it is logged in.
3. Five wrong tokens from one address in a minute lock that address out for a minute, even with the right token.

The cookie is HttpOnly, SameSite=Lax, Secure on TLS, lasts thirty days, and holds a value derived from the token, never the token. POST /logout clears it.

Where the token comes fromCopy Anchor Link

In order: --token, then SOLDERMASK_TOKEN, then .cache/access-token — generated on first start (24 random characters, file mode 0600) and reused after, so the QR code stays valid across restarts. It is printed at startup:

  access token : ExampleToken-NotYours-24   (other devices; this machine needs none)

--no-auth or SOLDERMASK_TOKEN=off opens the app to everyone on the network; the startup banner says access: OPEN.

Behind a proxyCopy Anchor Link

With a reverse proxy in front, every request arrives from loopback and the local exemption would admit everyone. Run with --proxy: X-Forwarded-For / -Proto / -Host are trusted and the token is required from every client, loopback included. See Deploying.

What is always openCopy Anchor Link

/api/health, /static/*, /manifest.webmanifest, /login and /logout. Everything else — pages, the API, the docs — is behind the rule.