Authentication Configuration

The auth section handles security credentials for the REST API. RUSEON Core uses JWT (JSON Web Tokens) with HMAC-SHA256 for secure API authentication.

JWT Secret

Field	Type	Description
secret	string	The HMAC-SHA256 signing key used to generate and validate JWTs.

Auto-Generation

TIP

If you leave the auth.secret field empty (or omit it entirely), RUSEON Core will automatically generate a secure 32-byte hexadecimal string on the first startup and save it back to config.yaml.

This ensures your installation is secure by default without requiring manual key generation.

Example

auth:
  secret: "your-secure-random-string-here"

Related Sections

• Server Settings