Skip to Content
API ReferenceAuth Service API

Auth Service API

End-user authentication for your auth apps lives at https://auth.ghayma.tech, not on the platform API. Every path is scoped by your app slug (app_id in the console):

https://auth.ghayma.tech/v1/{appSlug}/…

Credentials

  • Public endpoints (register, login, refresh, password reset, OAuth start, code exchange, native sign-in) take no credential.
  • Account endpoints (/me, change password, email change, 2FA management) take the end user’s access token: Authorization: Bearer <access_token>.
  • Servers that forward end-user traffic send X-Ghayma-Server-Key together with X-Ghayma-Client-IP (both or neither) so rate limits apply to the real client. See Auth Integration.

Errors and rate limits

Every error is JSON: { "error": "<message>" }, with a machine-readable code on newer endpoints (invalid_request, invalid_grant, invalid_token). A 429 carries Retry-After in seconds.

Contract

The reference below is rendered from the live OpenAPI 3.0.3 document the service publishes. Download it as openapi.yaml  or openapi.json  to generate a client in any language or to import it into Postman or Insomnia.

Two operations are marked pending in the document until the mobile OAuth release ships: POST /oauth/exchange and POST /oauth/id-token. See OAuth on Mobile.

Auth AppsConnections