Identity and Permissions

Gateway no longer exposes user-facing authentication endpoints.

Instead, identity is machine-to-machine between Gateway and Public API.

Gateway node identity

Gateway authenticates to Public API using:

• CONNECT_GATEWAY_ID
• CONNECT_GATEWAY_SECRET

If these are not provided, watcher auto-registers and stores issued credentials at:

• CONNECT_GATEWAY_CREDENTIALS_PATH (default /etc/minecraft/gateway-credentials.json)

API endpoints used by gateway runtime

• POST /v1/connect/gateways/register
• POST /v1/connect/gateways/{gatewayId}/heartbeat

Connect server route ownership endpoints

Connect plugins/mods publish or remove active route ownership with:

• GET /v1/connect/servers/{serverId}/gateways
• PUT /v1/connect/servers/{serverId}/gateway-route
• DELETE /v1/connect/servers/{serverId}/gateway-route

Operator permissions (Dash/API)

Gateway inventory/control in Dash is permission-gated in Public API.

Current admin endpoints:

• GET /v1/admin/connect/gateways
• GET /v1/admin/connect/gateway-routes
• PATCH /v1/admin/connect/gateways/{gatewayId}

Use the Connect gateway admin permission nodes in your role model to control read/manage access in Dash.