API Endpoints

Authenticating a user
Redirect the user to the /api/authenticate endpoint with the token (your client ID), redirect (the URL to redirect to, must match "Redirect URI" above), and (optionally) state GET parameters. The user will be prompted to approve app access, and then will be redirected back to your app with the authorization and state GET parameters. You must then send a request to /api/get_user_token (see below) to get a user token.

Use the user token value as the token below, unless the endpoint is documented as requiring your client secret instead. The user token (or client secret, if applicable) can be provided as either the Token HTTP header (recommended) or as the token GET parameter. All endpoints return JSON.

The user token expires 24 hours after it is granted; after that, you'll have to re-authenticate the user. Attempting to use invalid client IDs, user tokens, or client secrets will return 401 Not Authorized. Invalid endpoints will return 404 Not Found.
GET /api/get_user_token
Get a user token from an authentication token.
Note: requires a client secret. This should only be executed on your secure, remote server. Do not ship client secrets as part of a client-side app!

authorization The authorization token from the initial grant request

Example request:

authorization=58395fbcea6a76047df906f4bd564b7480b46943a723b24da2


Example response:

200 OK

{
	"token": "39bef4adff93d7e706b7dc8661ba8c60e5844b6b79c26cb019"
}

GET /api/user
Gets a user's information after you've authenticated them.

No parameters.

Example response:

200 OK

{
	"username": "antigravities",
	"uid": 1,
	"roles": [
		"administrator"
	]
}


GET /api/coins
Gets the number of loyalty credits a user has.

No parameters.

Example response:

200 OK

{
	"uid": 1,
	"coins": 100
}