Skip to main content
PUT
cURL

Authorizations

Authorization
string
header
required

How the StockShift apps sign in. The app opens /apps/authorize in the system browser with a PKCE S256 challenge and the thumbprint of its device key. The member signs in there, with every check the web enforces. The browser returns a code to the app, which trades it at POST /apps/token with the PKCE verifier and a DPoP proof (RFC 9449) signed by the device key. The answer holds an access token of one hour, which is sent as a bearer token on every call, and a rotating refresh token of 30 days. A refresh needs a DPoP proof with the server's latest nonce, so a stolen refresh token is useless without the device key. A session ends 180 days after sign-in at most. Every app request carries StockShift-Client: / (), such as ios/1.4.2 (311). Below the minimum of GET /apps/version-policy a call is answered 426 client_upgrade_required with the minimum and the store link. Below the deprecated-below version it works and the response adds StockShift-Client-Deprecated: sunset=; minimum=. Signing in and out, the device status, wipe receipt and PIN lock calls and the version policy answer every version.

Body

application/json

The push token an app got from APNs or FCM.

token
string
required

The device token from APNs (hex) or the registration token from FCM, as the platform gave it.

Maximum string length: 4096
Pattern: ^[A-Za-z0-9_:\-]+$
Example:

"7d1c2a4f0b6e9c3d8a5f2e1b4c7d0a9e6f3b8c5d2a1e4f7b0c3d6e9a2f5b8c1d"

environment
enum<string> | null

Which APNs servers know the token: sandbox for an iOS or macOS app built from Xcode, otherwise production, the default.

Available options:
production,
sandbox

Response

No content