Skip to main content
Endpoints that touch your data need an Authorization header:
Each endpoint page shows whether a token is required, optional, or not used. Public endpoints such as GET /public/posts and GET /health work without one. Optional-auth endpoints return extra data to the owner.

​
Get a token

The API accepts access tokens from any Nebyoulous sign-in: the web session, nebyoulous login, or an OAuth grant. For your own scripts, use OAuth. It’s standard OAuth 2.1 with the authorization code flow, PKCE (S256), and dynamic client registration. Clients are public, so there’s no client secret.
1

Register a client

Register once and keep the client_id. Any redirect URI works. A local one is easiest for scripts.
2

Make a PKCE pair

3

Approve in the browser

Open this URL, replacing CLIENT_ID and CHALLENGE:
Sign in, pick how long the token should last (7, 30, or 90 days), and choose Allow access. The browser goes to your redirect URI with ?code=...&state=xyz. If nothing is listening there, copy code from the address bar. Codes expire after 5 minutes.
4

Trade the code for tokens

The response has access_token, refresh_token, and expires_in in seconds. The token endpoint takes form-encoded bodies, not JSON.

​
Refresh

Both tokens last as long as you chose on the approval page. Refreshing issues a new pair and retires the old refresh token:

​
Discovery

Libraries that implement OAuth discovery can start from the metadata documents instead of these URLs:

​
Errors

An access token can do anything you can do in the web app. Keep it out of source control and logs. There’s no way to revoke one from the web app yet, so pick the shortest lifetime that works for your script.