HTTP reference#

Backu’s HTTP surface is split into account endpoints under /api/auth, CLI and app device authorization under /api/oauth, and authenticated filesystem reads under /api/machines.

Normal filesystem requests use five-minute bearer access tokens. Browser refresh credentials are rotating, opaque, and stored in an HTTP-only cookie. Device refresh credentials are returned only to the requesting CLI or app and can be revoked from the account panel.

The web app is the supported account client. Passkey ceremonies are origin-bound and should not be proxied through a different public origin.