Braiins Academy Authentication

generated: '2026-09-04'
method: searched
source: >-
  https://academy.braiins.com/braiins-hashpower/api.md,
  https://academy.braiins.com/braiins-pool/monitoring.md,
  https://developer.braiins-os.com/latest/openapi.json,
  https://github.com/braiins/bos-plus-api (proto/bos/v1/authentication.proto);
  the Hashpower securityScheme was derived from
  openapi/braiins-academy-braiins-hashpower-openapi.yml and upgraded from the docs.
description: >-
  Braiins runs three independent authentication models, one per API surface. There is no
  single Braiins identity across them: a Braiins Pool access-profile token does not
  authenticate Braiins Hashpower, and neither reaches a miner running Braiins OS, whose
  Public API authenticates against the device itself.
summary:
  types:
    - apiKey
    - http
  api_key_in:
    - header
  oauth2: false
  openid_connect: false
  mutual_tls: false
schemes:
  - name: ApiKey
    api: braiins-academy:braiins-hashpower-api
    type: apiKey
    in: header
    parameter: apikey
    description: >-
      API credential issued for a Braiins Hashpower account. The credential's ACL role and
      resource ownership determine which authenticated operations and records are available.
    token_types:
      - name: Owner Token
        access: Full access to all endpoints including trading
      - name: Read-only Token
        access: Market data and account viewing only
    issuance: >-
      Tokens are displayed once, immediately after Hashpower account registration at
      https://hashpower.braiins.com. Braiins states they are shown only once.
    acl_roles:
      - owner
      - read-only
      - contract-cancel-fee-public
    anonymous_endpoints: >-
      /spot/orderbook, /spot/trades, /spot/bars, /spot/stats are callable with no credential;
      /contract/cancel-fee accepts an optional key and returns generic fee layers without one.
    docs: https://academy.braiins.com/braiins-hashpower/api.md
    sources:
      - openapi/braiins-academy-braiins-hashpower-openapi.yml
  - name: PoolAuthToken
    api: braiins-academy:braiins-pool-api
    type: apiKey
    in: header
    parameter: Pool-Auth-Token
    alternate_parameter: X-Pool-Auth-Token
    description: >-
      Braiins Pool access-profile token. Each access profile carries its own token; a profile
      must have "Allow access to web APIs" enabled before a token can be generated.
    issuance: Settings > Access Profiles > Allow access to web APIs > Generate New token
    revocation: >-
      Regenerating a profile's token immediately invalidates the previous one. Tokens are
      scoped to the permissions of their access profile.
    docs: https://academy.braiins.com/braiins-pool/monitoring.md
    sources:
      - https://academy.braiins.com/braiins-pool/monitoring.md
  - name: BosSessionToken
    api: braiins-academy:braiins-os-api
    type: http
    scheme: bearer
    in: header
    parameter: Authorization
    description: >-
      Braiins OS Public API device session token. POST /api/v1/auth/login with the miner's
      username and password returns a token that must be sent in the Authorization header of
      subsequent requests. Authentication is against the individual miner, not a Braiins account.
    login_operation: login
    password_operation: setPassword
    grpc_equivalent: >-
      braiins.bos.v1.AuthenticationService (grpc/braiins-academy-bos-authentication.proto) —
      the gRPC surface issues the same session token.
    note: >-
      The published OpenAPI declares no components.securitySchemes and no top-level security[],
      so the Authorization requirement is documented in the login operation description and in
      the BOS gRPC docs rather than expressed in the machine-readable contract. Recorded as a
      contract gap, not as an absent auth model.
    docs: https://academy.braiins.com/braiins-os/papi-about.md
    sources:
      - openapi/braiins-academy-braiins-os-public-rest-api-openapi.json
      - grpc/braiins-academy-bos-authentication.proto
gaps:
  - >-
    Braiins OS Public REST API publishes no securitySchemes in its OpenAPI even though
    /api/v1/auth/login issues a bearer token — an agent reading only the spec cannot tell
    which operations require the token.
  - >-
    No OAuth 2.0 or OpenID Connect surface exists on any Braiins API; there is no delegated
    (third-party) authorization path, so scopes/ is not applicable.