From 3d93382d779b5bdb8c86993141c602d45a633f66 Mon Sep 17 00:00:00 2001
From: Maxim Devaev <mdevaev@gmail.com>
Date: Fri, 24 Oct 2025 02:47:59 +0300
Subject: [PATCH] update

---
 docs/api.md | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/docs/api.md b/docs/api.md
index 2805c04d..380a7041 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -80,6 +80,26 @@ There are two options here:
 
 3. The handle `POST /api/auth/logout` can be used to invalidate session token. The response codes will be similar to the previous handle.
 
+
+### Session-based login using HTML form
+
+You can submit PiKVM credentials from another site and go directly to the KVM page by passing the redirect parameter as follows:
+
+```html
+<html>
+<body>
+    <form method="POST" action="https://pikvm/api/auth/login">
+        <input name="user" value="admin">
+        <input name="passwd" value="admin">
+        <input name="expire" value="0">
+        <input name="redirect" value="/kvm/"> <!-- Available since KVMD 4.108 -->
+        <button type="submit">Open PiKVM</button>
+    </form>
+</body>
+<html>
+```
+
+
 -----
 ## WebSocket events
 
@@ -1929,4 +1949,4 @@ The `GET /api/export/prometheus/metrics` handle returns the Prometheus metrics.
 
 ```console
 $ curl -k -u admin:admin https://<pikvm-ip>/api/export/prometheus/metrics
-```
\ No newline at end of file
+```