A recipe export carries the recipe. An instance backup carries the whole
library too: books, tags, notes, ratings, cooking history, and earlier
versions. Pick the one that fits your integration.
An instance with sign-in enabled authenticates browser sessions and
personal API tokens. Send a token as an Authorization: Bearer header and name a library with X-Savorum-Library; scopes
and the account’s library membership both apply. Cookie-authenticated
writes also need the session-bound CSRF header, which bearer requests do
not.
The OpenAPI document declares these credentials as the bearerToken and browserSession security schemes, so a generated client
can send either, and operations that answer without credentials say so. An
instance left in local mode authenticates nobody: keep it private behind an
access-controlled network or proxy.