Authentication
Radioso has more than one authentication model because it serves more than one audience. A person in the dashboard, a script calling the API, and an anonymous visitor on your website all need to be trusted differently, so the web app, API, public chat, and Enterprise embed flows don’t share credentials. Pick the mode that matches who’s knocking.
Main access modes
- Session-based access for the product UI
- Workspace API tokens for backend-to-backend or developer automation
- Anonymous public chat and Enterprise embed flows for customer-facing agent experiences
Session-based access
Use sessions when a person is interacting with the product UI.
The main auth routes are:
- registration availability
- register
- login
- invitation accept
Use GET /api/v1/auth/registration to check whether open registration is available. It returns { "available": true } or { "available": false } without requiring authentication, so you can decide whether to show signup before anyone tries it.
On an empty open-source server, the first registration creates the server’s sole organization and default workspace. Open registration then closes, and later users join the existing organization by invitation. Enterprise Edition keeps open registration available and lets signed-in users create additional organizations. Authorized users can create additional workspaces in either edition; the edition boundary applies to organizations, not workspaces.
Registration sends a verification email and does not set a session cookie. The backend sets the cookie on successful login, invitation acceptance, and password reset confirmation. Open-source Radioso includes password reset and email verification endpoints, and normal sign-in requires a verified email address.
Workspace API tokens
Use a workspace token when you want to call the workspace-scoped API without a browser session. The usual pattern is:
Sign in with a normal user account
Use session auth to reach the account and workspace APIs.
Reveal the workspace token
Fetch the workspace token from the authenticated workspace route.
Call workspace-scoped APIs
Use the bearer token for document, chat, settings, and related automation flows.
A workspace token is a high-value credential: anyone holding it can act on the whole workspace. If one leaks, rotate it from workspace settings rather than trying to work around the exposure.
Public chat and embed access
Public website chat doesn’t use an operator session. It relies on workspace-controlled public settings, public chat tokens, or embed session flows that are scoped to the workspace configuration.
That’s the right model for customer-facing agents, and the wrong one for operator automation, because a public visitor should never hold an operator’s credentials. The hosted website widget is an Enterprise Edition surface; anonymous public chat uses the same public-session model without the widget routes.
Choose the right mode
- Use sessions for humans in the app.
- Use workspace bearer tokens for automation.
- Use public chat or Enterprise embed flows for customer-facing agents.