Authentication and access
The website and CLI use the same BrainMaps accounts. New accounts can sign in immediately; contribution approval is a separate step.
Access policy
| Action | Required access |
|---|---|
| Browse public catalogue metadata and public demos | No sign-in required |
| View hosted research datasets, layers, uploads and registration results | Signed-in active account; approval not required |
| Add a species under an existing category | Signed-in active account |
| Create, edit or delete categories; edit or delete existing species | Superadmin (is_superuser); ordinary staff status is insufficient |
| Upload data, create brains and submit processing work | Approved account or staff, plus any resource-specific ownership/governance checks |
| Administer an atlas | Atlas creator or an administrator appointed by that creator |
Read access does not grant permission to modify someone else’s data. Generic compute jobs are scoped to their creator for ordinary users; personal tokens are scoped to their owner. Saved viewer states can also be private.
The dataset policy applies to platform access. Some externally hosted sources and upload object URLs can be public. Do not treat login as a guarantee of private object storage.
Sign in
Use Sign in on the website, or:
brainmaps config set-api-url https://api.brainmaps.xyz
brainmaps loginThe CLI prompts for email and password. Use brainmaps signup to create an account from the terminal. Invalid credentials are reported as errors; commands do not automatically open a login screen.
API authentication
Both login/session tokens and personal access tokens use the same header:
Authorization: Token YOUR_TOKENBearer is not supported by the current token authenticator.
curl --fail https://api.brainmaps.xyz/api/auth/me/ \
-H "Authorization: Token $BRAINMAPS_API_KEY"See personal access tokens for creating and revoking tokens. The CLI reads BRAINMAPS_API_KEY or its saved configuration. It does not automatically load a project .env file.
Viewer sessions
For protected data under https://brainmaps.xyz/data/research/, the website requests POST /api/viewer-session/ with its API token. The API issues secure, HTTP-only CloudFront cookies scoped to /data, valid for 12 hours. The viewer renews them when needed. Any signed-in active account can obtain them.
An API token alone is not a CloudFront cookie. External viewers and download clients need the appropriate data access mechanism as well as an accessible source URL. DELETE /api/viewer-session/ clears the browser’s data cookies.
Logout and expiry
Logout revokes the token used for that request. Other tokens remain valid until revoked or until their expires_at is reached. Login currently does not set an inactivity expiry; do not rely on an automatic idle logout.
If you use BRAINMAPS_API_KEY, unset it after logout to stop the CLI from reading the old value. Inactive accounts and expired or revoked tokens are rejected.