cookieAuth: type: apiKey in: cookie name: token description: JWT stored in an HttpOnly cookie, obtained via POST /user/login.