Wger Authentication

generated: '2026-08-27'
method: searched
source: https://wger.readthedocs.io/en/latest/api/api.html
docs: https://wger.readthedocs.io/en/latest/api/api.html
spec: openapi/wger-openapi.yml
note: >-
  Derived from the securitySchemes in openapi/wger-openapi.yml (fetched from
  https://wger.de/api/v2/schema) and upgraded from the wger "Using the API"
  documentation. The API tries credentials in the order Token -> Bearer JWT ->
  session cookie. System-wide reference data (exercises, ingredients, units,
  muscles, equipment) is readable with no credential at all.
anonymous_access:
  supported: true
  scope: >-
    System-wide/community data: /api/v2/exercise*, /api/v2/ingredient*,
    /api/v2/muscle/, /api/v2/equipment/, /api/v2/exercisecategory/,
    /api/v2/language/, /api/v2/license/, /api/v2/public-templates/ and the
    setting-*unit reference endpoints.
  source: https://wger.readthedocs.io/en/latest/api/api.html
summary:
  types:
    - apiKey
    - http
    - oauth2
  api_key_in:
    - cookie
    - header
  oauth2_flows:
    - authorizationCode
schemes:
  - name: tokenAuth
    type: apiKey
    in: header
    parameter: Authorization
    prefix: 'Token '
    description: >-
      Permanent personal API key. Minted from the web UI at
      /en/user/api-key (User settings -> API key). Intended for personal
      scripts and long-running integrations; shown once.
    docs: https://wger.readthedocs.io/en/latest/api/api.html
    sources:
      - openapi/wger-openapi.yml
      - https://wger.readthedocs.io/en/latest/api/api.html
  - name: jwtAuth
    type: http
    scheme: bearer
    bearerFormat: JWT
    description: >-
      Short-lived JWT access token (10 minutes in the Docker default) paired
      with a long-lived refresh token (120 days). Lifetimes are configurable
      per instance via ACCESS_TOKEN_LIFETIME / REFRESH_TOKEN_LIFETIME.
      Recommended mechanism for apps.
    token_endpoints:
      refresh: POST /api/v2/token/refresh
      verify: POST /api/v2/token/verify
    rotation: >-
      Refresh rotates both tokens; the previous refresh token is blacklisted
      immediately.
    docs: https://wger.readthedocs.io/en/latest/api/api.html
    sources:
      - openapi/wger-openapi.yml
      - https://wger.readthedocs.io/en/latest/api/api.html
  - name: headlessJwtAuth
    type: http
    scheme: bearer
    bearerFormat: JWT
    description: >-
      Access token issued by the django-allauth headless endpoints. wger
      deliberately has no credentials-to-JWT endpoint because it would bypass
      2FA; a refresh token comes from POST /allauth/app/v1/auth/login (with a
      partial-login + X-Session-Token / requires_mfa step through
      POST /allauth/app/v1/auth/2fa/authenticate when 2FA is enabled), or from
      the web API key page.
    upstream_spec: https://docs.allauth.org/en/latest/headless/openapi-specification/
    sources:
      - openapi/wger-openapi.yml
      - https://wger.readthedocs.io/en/latest/api/api.html
  - name: oidcAuth
    type: oauth2
    description: >-
      wger can act as an OAuth2/OIDC provider itself (django-oauth-toolkit), so
      other applications can let their users sign in with a wger account and
      call the API on their behalf. Off by default unless the instance
      configures it; enabled on wger.de.
    flows:
      - flow: authorizationCode
        authorizationUrl: https://wger.de/identity/o/authorize
        tokenUrl: https://wger.de/identity/o/api/token
        scopes: 2
        pkce: S256
    discovery: https://wger.de/.well-known/openid-configuration
    jwks_uri: https://wger.de/.well-known/jwks.json
    userinfo_endpoint: https://wger.de/identity/o/api/userinfo
    revocation_endpoint: https://wger.de/identity/o/api/revoke
    device_authorization_endpoint: https://wger.de/identity/o/api/device/code
    grant_types:
      - authorization_code
      - client_credentials
      - refresh_token
      - 'urn:ietf:params:oauth:grant-type:device_code'
    docs: https://wger.readthedocs.io/en/latest/administration/oauth2_provider.html
    sources:
      - openapi/wger-openapi.yml
      - https://wger.de/.well-known/openid-configuration
  - name: cookieAuth
    type: apiKey
    in: cookie
    parameter: sessionid
    description: >-
      The Django session cookie a logged-in browser already carries. Used by
      wger's own web UI and by the browsable API.
    sources:
      - openapi/wger-openapi.yml