Authentication & Session

Current state

The extension currently operates in sandbox mode — it makes unauthenticated API calls to the local DMTR API at http://localhost:3100. No login, API keys, or session tokens are required.

The API URL is configurable via chrome.storage.local under the key dmtr_api_url.

Planned authentication

Planned additions:

• API key authentication (dmtr_sk_... keys stored in chrome.storage.local)
• OAuth flow for DMTR account connection (required for the Own tab)
• Scoped access: intelligence endpoints are read-only and available to all authenticated users
• Session refresh handled by the background service worker