---
title: "FitaLabs Gateway — Authentication"
description: "Documentation: FitaLabs Gateway — Authentication"
type: reference
tags: [infra, gateway, auth, oauth, magic-link, login]
timestamp: 2026-07-06
---

# FitaLabs Gateway — Authentication

Authentication flows implemented for the 1P and 3P bundles.

## 3P Mode (Claude Desktop/Code)

Desktop sends `x-api-key` or `Authorization: Bearer` directly.
LiteLLM proxy validates via `user_api_key_auth`.
Default API key: `sk-gateway-local`.

Desktop configuration:
```bash
ANTHROPIC_BASE_URL=https://api.unifita.app
# API key via settings or env var
```

## 1P Mode (Web Bundle)

Auth injected by Caddy in header:
```
header_up Authorization "Bearer sk-gateway-local"
```

All SPA `fetch()` calls to `/api/*`, `/v1/*`, `/bootstrap`, `/account_profile`
receive the header automatically. The SPA doesn't know it's authenticated.

## Auth Endpoints

### Login Methods
```
GET /api/auth/login_methods?email={email}&source=claude-ai
```
Returns available methods:
```json
{
  "methods": [
    {"type": "magic_link", "email": "user@example.com"},
    {"type": "google", "email": "user@example.com"}
  ]
}
```

### Magic Link
```
POST /api/auth/send_magic_link
Body: {"email": "user@example.com"}
```
Generates `ml_{uuid}` token, stores in `oauth_tokens`.
Returns link: `https://claude.unifita.app/login/verify?token={token}`

```
GET /api/auth/verify_magic_link?token={token}
```
Validates token, generates API key (`sk-fita-{uuid}`), returns:
```json
{"api_key": "sk-fita-...", "key_id": "key_...", "org_id": "..."}
```

### Google OAuth (pending)
SPA uses `accounts.google.com/gsi/status` with Anthropic's client ID:
`1062961139910-l2m55cb9h51u5cuc9c56eb3fevouidh9.apps.googleusercontent.com`

To work, it needs:
1. Create OAuth app in Google Cloud Console
2. Configure `client_id` and `client_secret` in the gateway
3. Endpoints: redirect URI, token exchange

Alternative: Authentik as IDP (LiteLLM supports OIDC).

## Account Profile

### GET /api/account_profile
Returns account + organization + settings:
```json
{
  "account": {
    "uuid": "64cb78fb-...",
    "email": "me@aleffita.dev",
    "name": "Alefita",
    "invites": [],
    "settings": {
      "has_finished_claudeai_onboarding": true,
      "has_accepted_tos": true
    }
  },
  "organization": {
    "uuid": "64cb78fb-...",
    "tier": "max",
    "capabilities": ["claude_code", "cowork", "voice", "mcp", "claude_max"]
  }
}
```

### PUT /api/account_profile
SPA does PUT to update onboarding settings:
```json
{"has_finished_claudeai_onboarding": true}
```

Stored in `managed_settings` via SQLite.

## Edge-API Bootstrap

```
GET /edge-api/bootstrap?statsig_hashing_algorithm=djb2&growthbook_format=sdk&include_system_prompts=false
```

Returns account + features + settings + growthbook. Most complete endpoint,
called by SPA at boot.

## LiteLLM Admin UI

- URL: `gateway.unifita.app` → `/ui`
- Login: `admin` / `admin` (UI_USERNAME/UI_PASSWORD)
- Session managed by proxy (PostgreSQL)
- Master key: `sk-gateway-local` (LITELLM_MASTER_KEY)

## References
- [[fitalabs-gateway-1p-jornada]] — overview
- [[fitalabs-gateway-bundle-1p]] — 1P bundle
- [[fitalabs-gateway-caddy]] — Caddy auth injection