GRIKAI
API
AuthenticationGRIKAI API

Developer API

Authentication

The API uses Grik account identity for key management and scoped developer API keys for production integrations.

User tokens

Use device login for browserless clients, local Ricochet tooling, and account-owned key management.

MethodEndpoint
POST/auth/device/code

Create a device code, user code, verification URL, expiry, and polling interval.

POST/auth/device/token

Exchange an approved device code for access and refresh tokens.

POST/auth/refresh

Rotate a refresh token and receive a fresh access token.

GET/users/me

Return the authenticated user profile used for billing and ownership.

Developer API keys

Use API keys for production server-side integrations. Keys are scoped and can be revoked.

MethodEndpoint
POST/auth/api-keys

Issue an organization API key such as grik_live_... for server-side integrations.

GET/auth/api-keys

List active and revoked API keys without exposing the raw secret.

DELETE/auth/api-keys/:id

Revoke an API key by id. Revoked keys fail authentication immediately.