Authentication

Nanami API uses bearer access tokens with refresh workflows.

In examples below, replace https://api.example.nanami.dev with your public Nanami API base URL.

Login flow

1. Call POST /api/v1/auth/login with email/password.
2. Receive access and refresh tokens.
3. Send access token as Authorization: Bearer <token>.

curl -X POST https://api.example.nanami.dev/api/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"[email protected]","password":"your-password"}'

Refresh flow

Call POST /api/v1/auth/refresh before access token expiry.

curl -X POST https://api.example.nanami.dev/api/v1/auth/refresh \
  -H 'Content-Type: application/json' \
  -d '{"refreshToken":"<refresh-token>"}'

Authenticated request example

curl https://api.example.nanami.dev/api/v1/networks \
  -H 'Authorization: Bearer <access-token>'

Additional auth workflows

• OAuth provider start/callback endpoints (/api/v1/auth/oauth/:provider/*)
• Invite acceptance (/api/v1/auth/invites/accept)
• Password reset request/confirm
• MFA enrollment and verification endpoints

Security notes

• Treat refresh tokens as long-lived credentials.
• Rotate compromised credentials immediately.
• Use TLS for all public API traffic.