WikifitaGitHub live67e8de5
projeto · infraestrutura/fitalabs-gateway-auth

FitaLabs Gateway — Authentication

Documentation: FitaLabs Gateway — Authentication

Baixar raw

FitaLabs Gateway — Authentication

Authentication flows implemented for the 1P and 3P bundles.

3P Mode (Claude Desktop/Code)

Desktop sends x-api-key or Authorization: Bearer directly. LiteLLM proxy validates via user_api_key_auth. Default API key: sk-gateway-local.

Desktop configuration:

ANTHROPIC_BASE_URL=https://api.unifita.app
# API key via settings or env var

1P Mode (Web Bundle)

Auth injected by Caddy in header:

header_up Authorization "Bearer sk-gateway-local"

All SPA fetch() calls to /api/*, /v1/*, /bootstrap, /account_profile receive the header automatically. The SPA doesn't know it's authenticated.

Auth Endpoints

Login Methods

GET /api/auth/login_methods?email={email}&source=claude-ai

Returns available methods:

{
  "methods": [
    {"type": "magic_link", "email": "user@example.com"},
    {"type": "google", "email": "user@example.com"}
  ]
}

Magic Link

POST /api/auth/send_magic_link
Body: {"email": "user@example.com"}

Generates ml_{uuid} token, stores in oauth_tokens. Returns link: https://claude.unifita.app/login/verify?token={token}

GET /api/auth/verify_magic_link?token={token}

Validates token, generates API key (sk-fita-{uuid}), returns:

{"api_key": "sk-fita-...", "key_id": "key_...", "org_id": "..."}

Google OAuth (pending)

SPA uses accounts.google.com/gsi/status with Anthropic's client ID: 1062961139910-l2m55cb9h51u5cuc9c56eb3fevouidh9.apps.googleusercontent.com

To work, it needs:

  1. Create OAuth app in Google Cloud Console
  2. Configure client_id and client_secret in the gateway
  3. Endpoints: redirect URI, token exchange

Alternative: Authentik as IDP (LiteLLM supports OIDC).

Account Profile

GET /api/account_profile

Returns account + organization + settings:

{
  "account": {
    "uuid": "64cb78fb-...",
    "email": "me@aleffita.dev",
    "name": "Alefita",
    "invites": [],
    "settings": {
      "has_finished_claudeai_onboarding": true,
      "has_accepted_tos": true
    }
  },
  "organization": {
    "uuid": "64cb78fb-...",
    "tier": "max",
    "capabilities": ["claude_code", "cowork", "voice", "mcp", "claude_max"]
  }
}

PUT /api/account_profile

SPA does PUT to update onboarding settings:

{"has_finished_claudeai_onboarding": true}

Stored in managed_settings via SQLite.

Edge-API Bootstrap

GET /edge-api/bootstrap?statsig_hashing_algorithm=djb2&growthbook_format=sdk&include_system_prompts=false

Returns account + features + settings + growthbook. Most complete endpoint, called by SPA at boot.

LiteLLM Admin UI

  • URL: gateway.unifita.app → /ui
  • Login: admin / admin (UI_USERNAME/UI_PASSWORD)
  • Session managed by proxy (PostgreSQL)
  • Master key: sk-gateway-local (LITELLM_MASTER_KEY)

References