3x-ui身份验证
支持两种身份验证模式。UI 会话使用登录端点设置的 Cookie。程序化客户端（机器人、脚本、远程面板）则使用从“设置 → 安全 → API Token”获取的 Bearer token 进行身份验证。两者都适用于 /panel/api/* 下的所有端点。
AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
application/json- body
username*stringPanel admin username.
password*stringPanel admin password.
twoFactorCode?stringOTP code when 2FA is enabled. Omit otherwise.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST "https://example.com/login" \ -H "Content-Type: application/json" \ -d '{ "username": "admin", "password": "admin", "twoFactorCode": "123456" }'{ "success": true, "msg": "Logged in successfully"}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST "https://example.com/logout"{ "success": true}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X GET "https://example.com/csrf-token"{ "success": true, "obj": "csrf-token-string"}AuthorizationBearer <token>Scoped API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
Successful response
application/json- response
success?booleanmsg?stringobj?unknowncurl -X POST "https://example.com/getTwoFactorEnable"{ "success": true, "obj": false}API 参考
3x-ui 面板的 REST API —— 涵盖认证、入站、客户端、服务器状态等，依据 OpenAPI 规范自动生成。
API 令牌
管理用于程序化认证的 Bearer 令牌（机器人、代表本节点操作的中心面板、CI）。每个令牌都有唯一的名称和一个启用标志——禁用即可在不删除的情况下吊销，删除则为永久吊销。令牌以 SHA-256 哈希形式存储，明文仅在创建响应中返回一次——此后无法再次获取，因此请当场复制保存。在任意 /panel/api/* 请求中以 <code>Authorization: Bearer <token></code> 的形式发送令牌——该令牌是一份完全管理员凭据。