From your app

Registering an app

Apps are registered under Settings → Apps, or an org's settings → Apps by its owners. The API is POST /user/apps and POST /orgs/{org}/apps, with a session.

Field	Value
name	The app's name.
origins	The origins its pages call from, as scheme://host[:port]. * admits any origin, only on an anonymous app with no issuers.
services	The services it reaches, as {owner}/{name}.
issuers	The OpenID Connect providers its users sign in with, each an https issuer URL and the audience of its ID tokens.
anonymous	Whether it admits calls with no signed-in user.

The app's id is what the browser sends.

A call

POST https://api.crab.talk/services/{owner}/{name}/tools/{tool}
X-App: {app id}
Authorization: Bearer {ID token}
Content-Type: application/json

Status	When
401	The app does not exist, the ID token does not verify against one of its issuers, or there is no ID token and the app is not anonymous.
403	The page's origin is not in origins, or the service is not in services.

An ID token is verified with its issuer's published keys, and its iss and aud must match one of the app's issuers.

What the service sees

• The call's account is the app's account. An app reaches a private service when its account is the service's account or a member of it.
• berm_lang::user() answers the signed-in user as their issuer and subject.
• A call with no signed-in user reaches only #[anonymous] tools.
• berm_lang::client() answers an id for the visitor, made from the service, the client's address and its user agent. It changes every UTC day.

Limits

• 600 calls a minute per signed-in user.
• 60 calls a minute per client address for anonymous calls.