Public API for mobile apps (Android, iOS) #44

New Issue

anas · 2026-10-08T21:32:10Z

anas commented

2026-10-08 21:32:10 +00:00

Owner direction (2026-10-08): reading features and account features (sign-in, library, word collection, …) must be usable by external clients such as Android and iOS apps.

Already in place: JSON endpoints; Bearer-token sessions (/api/auth/signin returns a token an app can keep); the site is itself a client of the same API.

To do

Versioned paths: /api/v1/... (keep the current paths as aliases for the site until it moves).
OpenAPI description of every endpoint, published with the site; example requests.
Expose the API publicly through Caddy (e.g. https://<domain>/api/v1), with HTTPS only.
Security fix before exposing it: rate limits read the client IP from x-client-ip, which only the site should send. Trust that header only from the site (loopback/private network or a shared secret); otherwise use the connection/proxy IP.
Rate limits per token as well as per IP; sign-in from apps without cookies; token revocation (sign out, sign out everywhere).
CORS stays closed (native apps do not need it); revisit if a third-party web client is wanted.
New endpoints from now on are written app-first: JSON in and out, Bearer auth, no site-only assumptions.

Owner direction (2026-10-08): reading features and account features (sign-in, library, word collection, …) must be usable by external clients such as Android and iOS apps. Already in place: JSON endpoints; Bearer-token sessions (`/api/auth/signin` returns a token an app can keep); the site is itself a client of the same API. To do - Versioned paths: `/api/v1/...` (keep the current paths as aliases for the site until it moves). - OpenAPI description of every endpoint, published with the site; example requests. - Expose the API publicly through Caddy (e.g. `https://<domain>/api/v1`), with HTTPS only. - **Security fix before exposing it**: rate limits read the client IP from `x-client-ip`, which only the site should send. Trust that header only from the site (loopback/private network or a shared secret); otherwise use the connection/proxy IP. - Rate limits per token as well as per IP; sign-in from apps without cookies; token revocation (sign out, sign out everywhere). - CORS stays closed (native apps do not need it); revisit if a third-party web client is wanted. - New endpoints from now on are written app-first: JSON in and out, Bearer auth, no site-only assumptions.

anas added this to the Phase 6: Operations and release milestone 2026-10-08 21:32:10 +00:00

anas referenced this issue from a commit

2026-10-08 21:35:36 +00:00

Personal library and word collection (#24, #25)

anas referenced this issue

2026-10-08 21:35:51 +00:00

Personal library: saved poets, works, couplets and words #45

anas referenced this issue

2026-10-09 15:35:07 +00:00

Operations: deploys without downtime, sync on the server, first GitHub release #22

anas referenced this issue

2026-10-09 15:38:57 +00:00