| Surface | Credential | Used on |
|---|---|---|
| Dashboard | JWT Bearer | /api/platform/* |
| Server API | pk_live_… API key | /api/v1/* |
| Hosted pay / public verify | None (rate-limited) | /api/public/gateway/* |
API keys
Create keys on the app (Apps → API keys). Prefer app-scoped keys. Send:
bash
Authorization: Bearer pk_live_...
# or query fallback:
GET https://verifyitet.duckdns.org/api/v1/credits/?api_key=pk_live_...Dashboard login
Telegram OIDC or phone OTP:
bash
POST https://verifyitet.duckdns.org/api/auth/telegram-login/
{ "id_token": "<OIDC JWT>" }
POST https://verifyitet.duckdns.org/api/auth/send-otp/ { "phone": "09xxxxxxxx" }
POST https://verifyitet.duckdns.org/api/auth/verify-otp/ { "phone", "code" }Trailing slashes
API routes expect trailing slashes (for example /api/v1/checkouts/).