Set up Coolify access

Coolify API token

coolify-sso needs a Coolify API token to list your applications on the dashboard. The token is used server-side only — it is never sent to the browser — and a read-only token is sufficient and recommended: nothing here writes through the Coolify API.

Create one under https://sso.studiomosaic.io/security/api-tokens (choose read-only), then paste it below. It is stored in a secrets.json file (mode 0600) on the shared config volume; the COOLIFY_API_TOKEN environment variable, when set, overrides it.

This request did not arrive through the oauth2-proxy forward-auth (no X-Auth-Request-Email header), so saving is disabled: the server refuses the POST to keep an unauthenticated visitor from planting a token. Open this page through your auth domain — or, for local development only, start the server with SETUP_ALLOW_UNAUTHENTICATED=true.

The token is validated with a live GET /api/v1/version call against https://sso.studiomosaic.io before it is persisted. Note: the save endpoint only accepts requests that carry the X-Auth-Request-Email header set by oauth2-proxy (unless the dev escape hatch above is enabled), so only signed-in users can configure it.