Raha Account API Documentation

Raha Account is the identity provider and account platform for Raha applications. It supports browser sign-in with OpenID Connect, OAuth token lifecycles, device authorization, account self-service, machine directory access, and administrative authorization.

Start here

1. Register a developer application and its exact redirect URIs.
2. Load /.well-known/openid-configuration from the issuer.
3. Use Authorization Code with S256 PKCE for interactive sign-in.
4. Validate issuer, audience, signature, expiry, state, and nonce.
5. Send access tokens as Authorization: Bearer {token} only to their intended audience.

API conventions

• Normal application APIs use /api/v1; protocol endpoints use /api/oauth2 without a version segment.
• JSON request and response fields use snake_case on the HTTP wire.
• Authentication and account responses are non-cacheable unless an endpoint explicitly says otherwise.
• x-request-id may be supplied by callers. Error responses expose x-reference-id for support correlation.
• Discover issuer endpoints instead of copying endpoint URLs between environments.