API
Overview of Comicarr's REST API, authentication, and real-time events.
Comicarr exposes a FastAPI REST surface under /api/. The web UI uses JWT session cookies. A smaller set of library browse endpoints accept the persistent API key for external tools.
Mylar3 cmd API removed
The legacy Mylar3-style GET /api?cmd=COMMAND&apikey=… dispatcher is not implemented in current Comicarr. Use the REST routes documented here, or the first-run migration wizard for Mylar3 imports.
Authentication at a glance
| Method | How | What it unlocks |
|---|---|---|
| Session cookie | Login at /api/auth/login → comicarr_session JWT | Full app API (series, search, downloads, config, AI, SSE, …) |
| API key | X-Api-Key header | REST-compat GET library endpoints only (/api/watchlist, /api/comics, …) |
| Setup token | Printed on first run | /api/auth/setup only |
Mutating requests (POST / PUT / DELETE / PATCH) require the CSRF header X-Requested-With: ComicarrFrontend (except /opds and /api/health).
Quick start
# Session login (saves cookie)
curl -c cookies.txt -X POST http://localhost:8090/api/auth/login \
-H "Content-Type: application/json" \
-H "X-Requested-With: ComicarrFrontend" \
-d '{"username": "admin", "password": "your_password"}'
# Session-authenticated request
curl -b cookies.txt http://localhost:8090/api/series
# API key (library browse only)
curl -H "X-Api-Key: YOUR_API_KEY" http://localhost:8090/api/watchlistRegenerate the API key under Settings → API & providers.