Authentication

API key, session, and rate limiting configuration for the Comicarr API.

Comicarr supports three authentication methods. The API is always enabled. An API key is auto-generated on first startup and can be regenerated in Settings > Web Interface.

Authentication Methods

Pass your API key in the X-Api-Key header:

curl -H "X-Api-Key: YOUR_API_KEY" http://localhost:8090/api/watchlist

Pass your API key as the apikey query parameter:

curl "http://localhost:8090/api?cmd=getIndex&apikey=YOUR_API_KEY"

Authenticate via the login endpoint to receive a session cookie. Subsequent requests use the cookie automatically.

# Login and save the session cookie
curl -c cookies.txt -X POST http://localhost:8090/api/auth/login \
  -H "Content-Type: application/json" \
  -H "X-Requested-With: ComicarrFrontend" \
  -d '{"username": "admin", "password": "your_password"}'

# Use the session cookie for API requests
curl -b cookies.txt http://localhost:8090/api/watchlist

Configuring the API Key

An API key is auto-generated when Comicarr first starts. To regenerate it:

  1. Open Settings > Web Interface in the Comicarr UI
  2. Click regenerate on the API key field
  3. Save settings

API key storage

The API key is auto-generated on first startup and stored in config.ini. It is never exposed in the UI after being set. You can regenerate it at any time from the settings page.

Session Endpoints

EndpointMethodDescription
/api/auth/loginPOSTJSON login (returns JWT session cookie)
/api/auth/logoutPOSTInvalidate current session
/api/auth/check-sessionGETVerify if current session is valid
/api/auth/setupPOSTFirst-run credential setup

Rate Limiting

Failed authentication attempts are rate-limited per IP address:

ParameterValue
Max attempts5
Lockout duration300 seconds

After 5 failed attempts from the same IP, all authentication requests from that IP are rejected for 300 seconds. This applies to both API key and session-based authentication.

On this page