Base address https://accounts.aidenkt.com. JSON bodies unless stated; every JSON answer carries Cache-Control: no-store.
| Method and Path |
Auth |
Notes |
GET /api/whoami (also GET /v1/me) |
Session cookie, from a registered aidenkt.com origin |
200 the person, 401 {"signedIn": false}. See Read Who Is Signed In |
GET /kit/manifest.json |
None |
The current kit file names and their SRI hashes |
GET /kit/kit.<hash>.js, /kit/kit.<hash>.css, /kit/fonts/* |
None |
The sign-in kit. CORS for allowed and registered origins only |
| Method and Path |
Auth |
Notes |
GET /.well-known/openid-configuration |
None |
Discovery |
GET /oauth/jwks.json |
None |
ES256 public keys |
GET /oauth/authorize |
The person signs in |
client_id, redirect_uri, response_type=code, scope, state, nonce, code_challenge, code_challenge_method=S256, prompt (none, consent) |
POST /oauth/token |
Client secret (Basic or form), or client_id alone for a public client |
Form body. grant_type=authorization_code, code, redirect_uri, code_verifier |
GET or POST /oauth/userinfo |
Bearer kto_… |
Claims for the granted scopes |
PUT /oauth/identity |
Bearer kto_… |
{displayName?, handle?, profileUrl?} |
DELETE /oauth/identity |
Bearer kto_… |
|
PUT /oauth/identity/picture |
Bearer kto_… |
Raw 512 x 512 WebP or JPEG |
DELETE /oauth/identity/picture |
Bearer kto_… |
|
The /oauth/* endpoints other than /oauth/authorize carry no cookies and answer Access-Control-Allow-Origin: * without credentials.
| Method and Path |
Auth |
Notes |
POST /api/agent/token |
Bearer ktk_… (the key) |
{access_token: "kta_…", expires_in: 3600, scope} |
GET /api/agent/whoami |
Bearer kta_… |
The agent, its current permissions, and whether its person is Aiden with their roles |
POST /api/agent/authorize |
Bearer kta_… |
{permission}: 200 {allowed: true} or 403. Audited |
POST /api/agent/device/code |
None |
Ask for access with a code a person approves |
POST /api/agent/device/token |
None |
Poll for the result |
GET, POST /api/agent/apps |
Bearer kta_…, apps.manage |
List, register |
GET, PATCH, DELETE /api/agent/apps/:id |
Bearer kta_…, apps.manage |
Read, change, delete |
POST /api/agent/apps/:id/secret |
Bearer kta_…, apps.manage |
Rotate the secret |
POST, PUT, DELETE /api/agent/apps/:id/icon |
Bearer kta_…, apps.manage |
Upload, make from the pack, remove |
The portal’s own API takes the same bodies and gives the same answers as the agent API. It needs a session on accounts.aidenkt.com with the Developer badge (or Aiden), a sign-in within the last 10 minutes for changes, and the accounts origin.
| Method and Path |
Notes |
GET, POST /api/developer/apps |
List, register |
GET, PATCH, DELETE /api/developer/apps/:id |
Read, change, delete. position is Aiden’s alone |
POST /api/developer/apps/:id/secret |
Rotate the secret |
POST, PUT, DELETE /api/developer/apps/:id/icon |
Upload, make from the pack, remove |
POST /api/developer/apps/:id/suspend, …/resume |
Aiden only |
| Method and Path |
Auth |
Notes |
GET /api/apps |
Session |
The person’s Your Apps tiles |
GET /api/apps/lookup?return_to=<url> |
None |
The active app a sign-in returns to, else 404 |
GET /api/me/apps |
Session |
The apps the person allowed, with their in-app identity |
DELETE /api/me/apps/:appId |
Session |
Removes the app for this person and ends its tokens |
