CorePOS API

HTTP handlers live under /api/*. Configure DATABASE_URL and AUTH_SECRET in .env.