Authentication and keys

Browser sessions through Thundera SSO, and API keys for scripts, SDKs and agent harnesses.

Two ways to authenticate

  • Browser session. Sign in with Thundera; the app sets a swarm_session cookie. It is re-validated against auth.thundera.eu every five minutes, so a revoked Thundera session ends here too, and refreshed transparently while you are active.
  • API key. Send Authorization: Bearer <key> (or x-api-key for the Messages route). Keys act as you, spend your credits and need no cookie.

Managing keys

Create, list and revoke keys on the API keys page or through /api/v1/api-keys. Only a prefix is kept for display; the secret exists in the creation response alone. Revoking a key takes effect immediately. A key can also revoke itself with POST /api/v1/api-keys/self/revoke.

Native clients

Native apps that hold a Thundera access token call POST /api/v1/auth/device-key to mint a key without a cookie jar. The desktop app does this on every launch and overwrites its previous credential.

Error shape

Every error uses one envelope, see Errors.

Source of truth: the Swarm repository