---
title: Super Lambda — Agent Authentication
description: How automated agents register an account and authenticate with the Super Lambda cookie-session API.
dateModified: 2026-08-02
canonical_url: https://superlambda.com/auth.md
---

# Super Lambda — Agent Authentication

This document tells automated agents how to register an account and authenticate
with the Super Lambda API. Authentication is **cookie-session based** (not OAuth 2.0).

- **Base URL:** `https://superlambda.com`
- **API spec:** [`/openapi.json`](https://superlambda.com/openapi.json)
- **API catalog:** [`/.well-known/api-catalog`](https://superlambda.com/.well-known/api-catalog)
- **Human docs:** [`/docs/api`](https://superlambda.com/docs/api)

## Identity & credential types

| | |
|---|---|
| Identity type | Email address |
| Credential type | Password (min 8 characters) |
| Session token | Opaque, delivered in the `sl_session` cookie (`HttpOnly; Secure; SameSite=Lax`), 7-day expiry |

## 1. Register an account

```http
POST /api/signup
Content-Type: application/json

{ "name": "Ada Agent", "email": "ada@example.com", "password": "a-strong-password" }
```

`201 Created` returns `{ "ok": true, "user": { ... } }` and sets the `sl_session`
cookie. `409` means the email is already registered.

## 2. Authenticate (existing account)

```http
POST /api/login
Content-Type: application/json

{ "email": "ada@example.com", "password": "a-strong-password" }
```

`200 OK` sets a fresh `sl_session` cookie. `401` means invalid credentials.

## 3. Use the session

Send the `sl_session` cookie with subsequent requests. Verify the session with:

```http
GET /api/me
Cookie: sl_session=<token>
```

`200` returns the current user; `401` means the session is missing or expired.

## 4. End the session

```http
POST /api/logout
Cookie: sl_session=<token>
```

## Rate limits

`/api/login` (20 / 15 min), `/api/signup` (10 / hour) and `/api/contact` (5 / hour)
are rate limited per client IP. Over-limit requests return `429` with a `Retry-After`
header (seconds).

## Notes for agents

- This site does **not** implement OAuth 2.0 / OIDC, so there is no
  `/.well-known/openid-configuration`, bearer-token, or `token_endpoint` flow.
  Authenticate with the cookie-session flow above.
- Passwords are stored only as PBKDF2-SHA256 hashes; they are never returned by any endpoint.