The API behind Vylra

One backend for the web and mobile apps: posts, people, messages, wallet and payments, campaigns and notifications.

https://api.dznhub.com/v1

Quick start

Three calls: sign in, use the token, keep the session alive.

Sign in

curl -X POST https://api.dznhub.com/v1/auth/login \
  -H 'content-type: application/json' \
  -d '{"email": "you@example.com", "password": "your password"}'

Call the API with the access token

curl https://api.dznhub.com/v1/auth/me \
  -H 'authorization: Bearer ACCESS_TOKEN'

Refresh before it expires (15 minutes)

curl -X POST https://api.dznhub.com/v1/auth/refresh \
  -H 'content-type: application/json' \
  -d '{"refresh_token": "REFRESH_TOKEN"}'

How it works

The same rules everywhere in the API.

Sessions

Access tokens last 15 minutes. Refresh tokens rotate on every use and work once; reusing an old one ends the session. Web apps send X-Vylra-Client: web and get the refresh token as an HttpOnly cookie instead. Public keys: /v1/auth/jwks.json.

Errors

Every error is application/problem+json with a stable code to branch on and a request_id to quote to support. See common codes.

Pagination

Lists return items and next_cursor. Pass the cursor back as cursor for the next page; it is null at the end.

Rate limits

Responses carry RateLimit and RateLimit-Policy headers. A 429 comes with Retry-After: wait that long, then retry.

Safe retries

Payment and money calls take an Idempotency-Key header: send the same key when you retry and the action happens only once.

Realtime

Messages, typing and notifications arrive over a WebSocket at /v1/realtime. Send the access token in the first message, {"type": "auth", "token": ...}, never in the URL.

Common error codes

The full list per endpoint is in the reference.

code	status	meaning
`validation_failed`	422	A field is missing or invalid; errors lists each field.
`auth.invalid_credentials`	401	Email or password is incorrect.
`auth.token_expired`	401	The access token expired: refresh it and retry.
`auth.session_expired`	401	The session ended (signed out, password changed): sign in again.
`auth.password_reset_required`	403	The account must set a new password; a link was emailed.
`auth.suspended`	403	The account is suspended.
`rate_limited`	429	Too many requests: wait Retry-After seconds.
`idempotency.key_required`	400	This POST needs an Idempotency-Key header.