Authentication

Two credential types exist. Both can be revoked independently.

API keys (recommended for integrations)

Send the key in the Authorization header — never in URLs.

Authorization: Bearer sgk_<prefix>_<secret>

• Only a SHA-256 hash of the key is stored; the plaintext secret is shown once at creation.
• Scopes: recognition:read, recognition:write, usage:read.
• Revocation takes effect immediately; expired keys are rejected.

Session cookies (dashboard)

Browser sessions use an HttpOnly; SameSite=Lax cookie named sg_session. State-changing requests additionally require the x-csrf-token header matching the non-HttpOnly sg_csrf cookie (double-submit CSRF protection). The frontend API client attaches this automatically.

Account security

• Passwords are hashed with Argon2id.
• Five failed logins lock the account for 15 minutes.
• Password reset and email verification use single-use, hashed tokens.
• Password reset responses never reveal whether an email is registered.