Developer documentation
Connect to the account API.
Authentication
The demo issues RS256 JWTs with a 15-minute lifetime. Send the token in the Authorization: Bearer <token> header. URL parameters and cookies are not authentication mechanisms.
Tokens must identify the TokenGate issuer, the account API audience, and an account with an active server-side authorization session. A directory entry alone does not authorize that account.
API operations
| Method | Endpoint | Operation |
|---|---|---|
| POST | /api/v1/demo-token | Send {} to obtain Alice's token only. |
| GET | /api/v1/me | Read the token's account. |
| GET / PATCH | /api/v1/accounts/{id}/profile | Read profile; update name and timezone. |
| GET / POST | /api/v1/accounts/{id}/records | List records; create a note with title and body. |
| GET / DELETE | /api/v1/records/{id} | Read a private record or remove an owned record. |
All writes require an application-issued RS256 token. Reads and writes are account-scoped. JSON errors include an HTTP status; a failed operation does not change account data.