fix: use Authentik domain URL for cookie domain compatibility

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.2] - 2026-01-01
+
+### Fixed
+
+- Use Authentik domain URL (auth.schweitz.net) instead of IP to fix cookie domain matching
+
+## [1.4.1] - 2026-01-01
+
+### Fixed
+
+- Authentik config now uses AUTHENTIK_USERNAME/PASSWORD to match production env vars
+
 ## [1.4.0] - 2026-01-01
 
 ### Added

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "core-api"
-version = "1.4.0"
+version = "1.4.2"
 description = "Core Code API - Infrastructure management and tools API"
 readme = "README.md"
 requires-python = ">=3.12"

src/auth/service.py

@@ -296,7 +296,7 @@ class AuthService:
         if data.get("component") == "ak-stage-identification":
             resp = await client.post(
                 flow_url,
-                json={"uid_field": settings.authentik_admin_user},
+                json={"uid_field": settings.authentik_username},
                 headers=headers,
             )
             resp.raise_for_status()
@@ -312,7 +312,7 @@ class AuthService:
         if data.get("component") == "ak-stage-password":
             resp = await client.post(
                 flow_url,
-                json={"password": settings.authentik_admin_password},
+                json={"password": settings.authentik_password},
                 headers=headers,
             )
             resp.raise_for_status()
@@ -342,8 +342,8 @@ class AuthService:
         Returns:
             BulkSyncResultSchema with counts of created/updated/failed users
         """
-        if not settings.authentik_admin_user or not settings.authentik_admin_password:
-            raise ValueError("AUTHENTIK_ADMIN_USER and AUTHENTIK_ADMIN_PASSWORD must be configured")
+        if not settings.authentik_username or not settings.authentik_password:
+            raise ValueError("AUTHENTIK_USERNAME and AUTHENTIK_PASSWORD must be configured")
 
         created = 0
         updated = 0

src/config.py

@@ -121,9 +121,10 @@ class Settings(BaseSettings):
     oidc_audience: str = "core-api"
 
     # Authentik API (for token validation and user management)
-    authentik_url: str = "http://192.168.86.149:9000"  # Authentik base URL
-    authentik_admin_user: str = ""  # Admin username for API access
-    authentik_admin_password: str = ""  # Admin password for API access
+    # Must use domain name (not IP) when AUTHENTIK_COOKIE_DOMAIN is set
+    authentik_url: str = "https://auth.schweitz.net"  # Authentik base URL
+    authentik_username: str = ""  # Admin username for API access (AUTHENTIK_USERNAME env var)
+    authentik_password: str = ""  # Admin password for API access (AUTHENTIK_PASSWORD env var)
 
     @property
     def model_aliases(self) -> dict: