Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/HNU-himematsu/HNU-TimeLetter/llms.txt

Use this file to discover all available pages before exploring further.

The HNU-TimeLetter admin API uses two distinct authentication mechanisms: an HttpOnly session cookie (admin_auth) for all admin management endpoints, and a Bearer token for the Feishu Automation webhook. Public frontend data endpoints (/api/content, /api/contributors, /api/creation-board, /api/announcement-config, /api/feishu-jsapi-signature) require no authentication at all.

​
Session Cookie Authentication

Admin endpoints are protected by an admin_auth cookie that is set on successful login and must be present on every subsequent request. The cookie is HttpOnly so it cannot be read by JavaScript — the browser (or curl’s cookie jar) handles it automatically.
The login endpoint itself — POST /api/admin/login — does not require a cookie. It is the only admin-prefixed endpoint that is publicly accessible.

​
Logging In

Send a POST request to /api/admin/login with the admin password in the JSON body. The password is validated against the ADMIN_PASSWORD environment variable. 
curl -X POST https://himematsu.cn/api/admin/login \
  -H "Content-Type: application/json" \
  -d '{"password": "your-password"}' \
  -c cookies.txt
Success response — 200 OK: 
{ "success": true }
The server includes a Set-Cookie header in the response that sets the admin_auth cookie. The -c cookies.txt flag tells curl to save the cookie to a file for use in subsequent requests. Password incorrect — 401 Unauthorized: 
{ "success": false, "message": "Invalid password" }

​
Cookie Properties

PropertyValue
Nameadmin_auth
HttpOnlyYes — not accessible via document.cookie
SecureYes (production only)
SameSiteLax
Max-Age7 days (604800 seconds)

​
Making Authenticated Requests

Once you have the admin_auth cookie, include it in every admin API call. Browsers do this automatically for same-origin requests. With curl, use the -b flag to read the saved cookie file: 
curl -X GET https://himematsu.cn/api/admin/sync/config \
  -b cookies.txt
Any request to an admin endpoint that is missing a valid admin_auth cookie receives a 401 Unauthorized response: 
{ "message": "Unauthorized" }

​
Logging Out

Send a DELETE request to /api/admin/login. The server clears the admin_auth cookie by setting Max-Age=0 in the response Set-Cookie header. 
curl -X DELETE https://himematsu.cn/api/admin/login \
  -b cookies.txt \
  -c cookies.txt
Success response — 200 OK: 
{ "success": true }

​
Login Rate Limiting

The login endpoint enforces a brute-force lockout to protect against password guessing.
  • After 5 consecutive failed login attempts, the endpoint enters a 30-minute cooldown for the offending client.
  • During the cooldown window, all login attempts return 429 Too Many Requests:
{
  "success": false,
  "message": "Too many failed attempts",
  "retryAfterSeconds": 1800
}
  • The lockout resets automatically once the 30-minute cooldown window expires. The Retry-After: 1800 HTTP header is also set on the response.
Successful logins do not count toward the failure counter. Only consecutive failed password attempts trigger the lockout.

​
Webhook Bearer Token Authentication

The Feishu Automation webhook endpoint — POST /api/admin/sync/webhook — does not use the session cookie. Instead, it uses a Bearer token to accommodate Feishu’s HTTP request automation action, which may not support custom cookie headers.

​
Token Source

The webhook secret is read from the SYNC_WEBHOOK_SECRET environment variable. If SYNC_WEBHOOK_SECRET is not set, the server falls back to ADMIN_PASSWORD.
Do not rely on the ADMIN_PASSWORD fallback in production. If the webhook is called with the ?secret= query parameter, the token value will appear in server access logs and request logs — exposing your admin password. Always set SYNC_WEBHOOK_SECRET to a separate, independent secret value in production deployments.

​
Authentication Methods

The webhook accepts the token via either method — use whichever your automation platform supports:
MethodExample
Authorization headerAuthorization: Bearer <SYNC_WEBHOOK_SECRET>
secret query parameter?secret=<SYNC_WEBHOOK_SECRET>
The Authorization header is recommended because the token does not appear in URL logs.

​
Webhook Call with Bearer Header (Recommended)

curl -X POST https://himematsu.cn/api/admin/sync/webhook \
  -H "Authorization: Bearer your-webhook-secret"
To sync specific tables, add the tables query parameter (comma-separated table keys): 
curl -X POST "https://himematsu.cn/api/admin/sync/webhook?tables=creation_board,creation_headers" \
  -H "Authorization: Bearer your-webhook-secret"
If tables is omitted, the webhook defaults to syncing creation_board. Success response — 202 Accepted: 
{
  "jobId": "sync_20260430100000_ab12cd",
  "status": "queued",
  "message": "同步任务已创建"
}

​
Webhook Call with Query Parameter

Use this form when your Feishu Automation action does not support custom request headers: 
curl -X POST "https://himematsu.cn/api/admin/sync/webhook?secret=your-webhook-secret"
Authentication failure — 401 Unauthorized: 
{ "message": "Unauthorized" }

​
Authentication Flow Summary

1

Log in to obtain a session cookie

POST /api/admin/login with { "password": "..." } in the request body. On success, the admin_auth cookie is set in the response.
2

Include the cookie on every admin request

Browsers attach the cookie automatically. CLI tools like curl require the -b cookies.txt flag. The cookie is valid for 7 days.
3

Handle 401 responses

If a request returns 401 Unauthorized, the session has expired or was never established. Log in again to obtain a fresh cookie.
4

Log out when finished

DELETE /api/admin/login to invalidate the session and clear the cookie immediately.

​
curl Examples Reference

1 — Login and save cookie: 
curl -X POST https://himematsu.cn/api/admin/login \
  -H "Content-Type: application/json" \
  -d '{"password": "your-password"}' \
  -c cookies.txt
2 — Authenticated admin request (read sync config): 
curl -X GET https://himematsu.cn/api/admin/sync/config \
  -b cookies.txt
3 — Logout: 
curl -X DELETE https://himematsu.cn/api/admin/login \
  -b cookies.txt \
  -c cookies.txt
4 — Webhook with Bearer header: 
curl -X POST https://himematsu.cn/api/admin/sync/webhook \
  -H "Authorization: Bearer your-webhook-secret"
5 — Webhook with query parameter (for Feishu Automation): 
curl -X POST "https://himematsu.cn/api/admin/sync/webhook?secret=your-webhook-secret"

Build docs developers (and LLMs) love

Get started for freeTalk to us