generated: '2026-08-23'
method: derived
source: graphql/ink-games-cms-schema.graphql + live probes of every INK Games API host
description: >-
  Authentication profile for the INK Games API surface. INK Games publishes no
  developer authentication documentation of any kind — there is no developer portal,
  no API key issuance flow, and no OAuth or OIDC discovery document on any host (see
  well-known/ink-games-well-known.yml). Everything below is derived from the GraphQL
  schema retrieved by anonymous introspection and from the responses the live hosts
  actually returned.

schemes:
  - id: strapi-users-permissions-jwt
    type: http
    scheme: bearer
    bearerFormat: JWT
    surface: https://webadm.inkgames.com/graphql
    method: derived
    source: graphql/ink-games-cms-schema.graphql
    evidence: >-
      The schema exposes the Strapi users-permissions plugin: mutation login(input:
      UsersPermissionsLoginInput!): UsersPermissionsLoginPayload! returning a `jwt`
      String and a `user` UsersPermissionsMe, plus register, forgotPassword,
      resetPassword, changePassword and emailConfirmation. UsersPermissionsLoginInput
      takes identifier/password/provider, so the credential is an identifier+password
      exchanged for a JWT presented as `Authorization: Bearer <jwt>`.
    documented_by_provider: false
    note: >-
      Strapi's users-permissions plugin also accepts a long-lived API token as a
      bearer credential on the same header. Which credential class INK Games actually
      issues is not observable anonymously.

  - id: aws-api-gateway-unknown
    type: unknown
    surface: https://ip-api.inkgames.com
    method: probed
    source: 'HTTP probe 2026-08-23'
    evidence: >-
      Every path probed returned HTTP 403 {"message":"Missing Authentication Token"},
      which is AWS API Gateway's standard response for a route that does not exist on
      the deployed API, not an authentication challenge. No WWW-Authenticate header,
      no OAuth metadata document, no error body naming a scheme.
    documented_by_provider: false
    note: >-
      The dashboard bundle at https://dashboard.inkgames.com/assets/index-18895c2e.js
      calls https://ip-api.inkgames.com/user/validate-auth-code, and the shell loads
      simplewebauthn (/vendors/simplewebauthn/index.es5.umd.min.js), so the consumer
      login flow involves an emailed/SMS auth code plus WebAuthn passkeys. The wire
      credential for the API itself is not published and was not observed.

anonymous_access:
  graphql_introspection: allowed
  graphql_resolvers: denied
  note: >-
    Anonymous callers can read the complete GraphQL type system but every resolver
    returns {"errors":[{"message":"Forbidden access","extensions":{"code":"FORBIDDEN"}}]}.
    The Strapi Public role has no content permissions granted.

not_present:
  oauth2: >-
    No oauth2 securityScheme, no /.well-known/oauth-authorization-server on any host,
    no documented authorization or token endpoint. No scopes artifact is derivable.
  openid_connect: No /.well-known/openid-configuration on any host (all probes 404 or soft-404).
  mtls: Not offered or documented.
  api_key_program: No public key issuance, no developer account, no key-prefix convention published.

observations:
  - id: cors-wildcard-with-credentials
    severity: informational
    surface: https://webadm.inkgames.com/graphql
    finding: >-
      The endpoint returns `access-control-allow-origin: *` together with
      `access-control-allow-credentials: true` on an anonymous request. Browsers
      reject that combination, so it is a misconfiguration rather than an exposure,
      but it is the deployed header set.
    evidence: 'observed response headers, POST https://webadm.inkgames.com/graphql, HTTP 200, 2026-08-23'
  - id: stack-traces-in-errors
    severity: informational
    surface: https://webadm.inkgames.com/graphql
    finding: >-
      Anonymous FORBIDDEN responses include a full `extensions.stacktrace` array
      disclosing absolute server filesystem paths (/home/ubuntu/strapi/ink-web/...)
      and the Strapi plugin version layout. Strapi suppresses this when NODE_ENV is
      production.
    evidence: 'observed response body, POST https://webadm.inkgames.com/graphql, HTTP 200, 2026-08-23'