Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.delino.io/llms.txt

Use this file to discover all available pages before exploring further.

Delino provides secure authentication, offering safe access to the platform through multiple authentication methods. This guide covers authentication mechanisms, security features, and best practices.

​
Authentication Methods

Delino supports two primary authentication methods:

Web Authentication

Dashboard Access
  • Email/password login
  • Social login support
  • Automatic session refresh
  • Session management
  • Secure token-based authentication

API Keys (PATs)

Programmatic Access
  • Used for API and service integration
  • Personal Access Tokens
  • Fine-grained scope permissions
  • Restricted to public APIs only
  • No dashboard access

​
Authentication Flow

​
How Authentication Works

Delino’s authentication flow:
1

User Initiates Login

User navigates to Delino and clicks “Sign In”
2

Authentication Page

User directed to authentication page:
  • Email/password login
  • Social login options
3

Credential Verification

System verifies credentials and validates user identity
4

Session Established

User redirected back to Delino with active session:
  • User record created/updated
  • Session established
  • Dashboard access granted

​
API Key Authentication

​
Personal Access Tokens (PATs)

API keys provide secure programmatic access:
API keys are restricted to public APIs only. They cannot access internal or admin endpoints.
Key Features:
  • Created through Delino console
  • Securely managed backend
  • Fine-grained scope permissions
  • Optional expiration (up to 100 years)
  • Token value shown only once at creation
Authentication Flow: 
API Request
├── Header: Authorization: Bearer deli_...
├── Extract token from header
├── Validate token
├── Verify scopes for requested operation
└── Grant/Deny access

​
Scope-Based Authorization

API keys use scopes to control access: Format: service:resource:action Examples:
  • * - Full access (development only)
  • service:* - All operations for a specific service
  • service:resource:action - Specific operation only
See API Key Scopes for complete reference.

​
Public API Restriction

API keys (PATs) can only access public APIs. Private and admin endpoints require web session authentication.
Public APIs (accessible with API keys):
  • Service-specific operations
  • Usage reporting
  • Resource management within scope
Private APIs (require web session):
  • Admin operations
  • User management
  • System configuration
  • Billing portal access (except via specific scope)

​
API Key Security

API keys generated securely:
  • Cryptographic random suffix (24 bits entropy)
  • Unique internal names
  • Collision-resistant
  • Unpredictable values
API keys stored securely:
  • Token value hashed
  • Only shown once at creation
  • Database stores hash only
  • Cannot be recovered if lost
API keys transmitted securely:
  • HTTPS only
  • Authorization header
  • Never in URL parameters
  • Never in logs
API keys validated on every request:
  • Token signature check
  • Expiration verification
  • Scope validation

​
Session Management

​
Web Sessions

Dashboard sessions managed automatically:
​
Session Duration
duration
Typically 7-30 days with automatic refresh
​
Idle Timeout
duration
Configurable per organizationDefault: 30 minutes of inactivity
​
Concurrent Sessions
number
Multiple sessions allowedEach device maintains separate session

​
Session Features

  • Auto Refresh: Sessions automatically refreshed before expiration
  • Remember Me: Optional extended session duration
  • Multiple Devices: Access from multiple devices simultaneously

​
Security Best Practices

For your account:
  • Minimum 12 characters
  • Mix of letters, numbers, symbols
  • Avoid common patterns
  • Use password manager
Two-factor authentication:
  • TOTP (Google Authenticator, etc.)
  • SMS verification (if enabled)
  • Backup codes
  • Required for admin accounts
Regular API key rotation:
  • Every 90-365 days
  • After team member departure
  • On security incident
  • Document rotation schedule
Review active sessions:
  • Check for unknown devices
  • End inactive sessions
  • Review login history
  • Report suspicious activity
Apply principle of least privilege:
  • Minimum required scopes for API keys
  • Appropriate team roles
  • Regular permission audits
  • Remove unnecessary access
Protect authentication credentials:
  • Never share passwords
  • Never commit API keys to git
  • Use environment variables
  • Rotate on exposure

​
Troubleshooting

​
Cannot Log In

If you cannot log in to Delino:
  1. Verify Email: Ensure using correct email address
  2. Reset Password: Use password reset function
  3. Browser Issues: Clear cache and cookies
  4. Contact Support: If problem persists

​
Session Errors

If you experience session issues:
  1. Session Expired: Log out and log in again
  2. Clear Session: Clear browser cache and cookies, then re-authenticate
  3. Contact Support: If problem persists

​
API Key Not Working

If API key authentication fails:
  1. Check Expiration: Verify key hasn’t expired
  2. Verify Scopes: Ensure key has required permissions
  3. Public API: Confirm endpoint is public (not admin)
  4. Header Format: Use Authorization: Bearer deli_...
  5. Test Key: Try simple API call to verify

​
Next Steps

API Keys

Learn how to create and manage API keys

Teams

Understand team-based authentication