Pinter uses token-based authentication with refresh support. The frontend stores auth state in Zustand and sends bearer tokens through the shared authenticated request module.

​
Sign-in methods

Users change their password from the user menu in the sidebar, which opens the change password dialog.

​
Frontend auth state

Auth state lives in:
Stored fields include:
  • Access token.
  • Refresh token.
  • Current user.
  • Authentication status.
On rehydration, the store checks token expiry. Expired sessions are cleared unless the refresh token can still be used.

​
Authenticated requests

All authenticated frontend calls should use:
This module:
  • Adds Authorization: Bearer <token>.
  • Refreshes tokens before requests when needed.
  • Retries once after 401.
  • Logs out when refresh fails.
  • Parses backend detail errors into AuthError.

​
Route guards

Frontend guards live in:
Users who fail a guard are redirected to /chat.

​
Role levels

​
Access grants

Grants control which users can use or edit a specific agent. A grant is created in one of three ways: Grant endpoints: Admins review and manage grants from the Users admin area at /admin/users.

​
Backend route groups

Backend routes use FastAPI dependencies such as active user and admin user checks. Common protected route groups:
Do not treat frontend guards as security controls. Backend dependencies and database authorization checks must enforce access.