Davi Developers LogoDavi Developers

Documentation

Quickstart

Register an app, sign in a Davi user, and make your first API call.

This guide takes you from zero to your first authenticated request in four steps. The Davi API is served under https://api.davi.social/api/v1 and authenticates every request with an OAuth 2.0 bearer token.

Prerequisites

  • A Davi account that owns or manages an organization (apps are registered per organization).
  • Access to the Davi dashboard.

1. Register an app

In the dashboard, open your organization and go to Developer → Apps → Create app. Choose a client type:

  • Server-side application (confidential) — backend services or web apps with a server that can keep a secret. Receives a client_secret.
  • Client-side application (public) — mobile, desktop, or single-page apps. Uses PKCE instead of a secret.

Add at least one redirect URI (where users return after authorizing, e.g. https://yourapp.com/callback). On creation you'll get a Client ID and, for confidential apps, a Client Secret.

Copy the client secret now — it is shown only once. You can rotate it later from the app's detail page.

2. Send the user to authorize

Redirect the user to the authorization endpoint. Davi uses the authorization code flow with PKCE, so generate a code_verifier and its S256 code_challenge first.

GET https://api.davi.social/oauth2/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.com/callback
  &scope=openid profile
  &state=RANDOM_STATE
  &code_challenge=CODE_CHALLENGE
  &code_challenge_method=S256

The user signs in and consents. Davi redirects back to your redirect_uri with a short-lived code and your state. See Authorization code flow for handling the login_required and consent_required responses.

3. Exchange the code for tokens

Exchange the code at the token endpoint. Confidential clients authenticate with their secret (HTTP Basic or form fields); public clients send only the code_verifier.

curl -X POST "https://api.davi.social/oauth2/token" \
  -u "YOUR_CLIENT_ID:YOUR_CLIENT_SECRET" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=AUTHORIZATION_CODE" \
  -d "redirect_uri=https://yourapp.com/callback" \
  -d "code_verifier=CODE_VERIFIER"

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "def502...",
  "scope": "openid profile",
  "id_token": "eyJhbGciOi..."
}

4. Call the API

Send the access token as a bearer token on every request. A good first call is the current user:

curl "https://api.davi.social/api/v1/users/me" \
  -H "Authorization: Bearer ACCESS_TOKEN"

That's it — you've signed in a Davi user and made an authenticated request.

Where to go next