Developer API
Authentication
The API uses Grik account identity for key management and scoped developer API keys for production integrations.
#User tokens
Use device login for browserless clients, local Ricochet tooling, and account-owned key management.
| Method | Endpoint | Auth | Scope | Audience | Description |
|---|---|---|---|---|---|
| POST | /auth/device/code | None | - | Developers | Create a device code, user code, verification URL, expiry, and polling interval. |
| POST | /auth/device/token | None | - | Developers | Exchange an approved device code for access and refresh tokens. |
| POST | /auth/refresh | None | - | Developers | Rotate a refresh token and receive a fresh access token. |
| GET | /users/me | Bearer token | - | Developers | Return the authenticated user profile used for billing and ownership. |
/auth/device/codeCreate a device code, user code, verification URL, expiry, and polling interval.
/auth/device/tokenExchange an approved device code for access and refresh tokens.
/auth/refreshRotate a refresh token and receive a fresh access token.
/users/meReturn the authenticated user profile used for billing and ownership.
#Developer API keys
Create and manage bearer API keys. Scopes below apply to API keys; user access tokens are authenticated separately.
| Method | Endpoint | Auth | Scope | Audience | Description |
|---|---|---|---|---|---|
| POST | /auth/api-keys | User token | - | Developers | Issue an organization API key such as grik_live_... for server-side integrations. |
| GET | /auth/api-keys | User token | - | Developers | List active and revoked API keys without exposing the raw secret. |
| PATCH | /auth/api-keys/:id | User token | - | Developers | Update key metadata, scopes, environment, status, or spend controls without revealing the raw secret. |
| DELETE | /auth/api-keys/:id | User token | - | Developers | Revoke an API key by id. Revoked keys fail authentication immediately. |
/auth/api-keysIssue an organization API key such as grik_live_... for server-side integrations.
/auth/api-keysList active and revoked API keys without exposing the raw secret.
/auth/api-keys/:idUpdate key metadata, scopes, environment, status, or spend controls without revealing the raw secret.
/auth/api-keys/:idRevoke an API key by id. Revoked keys fail authentication immediately.