# Authentication and scope

Use the correct session, CSRF protection and institution/environment scope.

## Portal session

POST /portal-api/login starts a session using a username and password. The HTTPS cookie is named __Host-sigillum-session. GET /portal-api/session returns the current scope and CSRF value. Preserve same-origin checks and CSRF protection.

## Scope and mutation headers

| Header | Purpose |
|---|---|
| X-Sigillum-Csrf | Session-provided token for protected/mutating POST actions |
| X-Sigillum-Institution | Selected institution identity |
| X-Sigillum-Environment | Selected environment identity |

Headers must agree with the authorised session; they do not grant access to another institution. Use the /portal-api/scope flow and refreshed session values when changing scope.

## SDK service identity

Use the config.json generated for the service. sourceToken is service-scoped; signed entry profiles establish application context. Keep credentials out of public pages, issues and examples. Use the supplied SDK rather than manually imitating its binary delivery protocol with cURL.