API Authentication
The Murmur API (murmur-api, reachable at https://murmurmusic.ai/api/v1)
uses two auth models depending on the caller:
Bearer license-key auth
Section titled “Bearer license-key auth”Third-party integrations, Tidepool, and the plugins themselves authenticate with a Bearer token in the same key space as license activation.
$
curl -H "Authorization: Bearer $MURMUR_LICENSE_KEY" https://murmurmusic.ai/api/v1/catalogSession-cookie auth
Section titled “Session-cookie auth”The website and admin UI use an HS256 session cookie issued under
/api/auth/* (login, signup, Google/GitHub OAuth, password reset). A small
set of routes — like patch downloads — accept either a session cookie or a
Bearer token, so a signed-in browser session and a Tidepool install both
work.
Rate limits
Section titled “Rate limits”- API reference for the full endpoint list
- Troubleshooting if a request that should succeed is failing