Authentication | Bibleit API Reference

Credential	Use	Lifecycle
Personal API token, `bt_`	Own identity/account, reading and personal Reader Lives	Finite lifetime; current personal authority and token scope rules apply
Delegated access token, `oa_`	Registered client’s consented personal access	At most 15 minutes; explicit grant scopes and current owner authority
Delegated refresh token, `or_`	Refresh a registered personal OAuth grant	Single-use rotation within a fixed 30-day grant; never a REST bearer token
Browser session	Browser forms and OAuth consent	Not accepted as REST bearer authentication

Organization backends use scoped svc_ service tokens. Their creation, rotation, permissions and workspace examples are in the Organizations section.

REST requests send Authorization: Bearer <token>. Service tokens cannot become personal accounts or browser sessions. Personal and delegated tokens cannot manage organization membership, Studio settings, presentations or workspace moves. Tokens never bypass current ownership, organization status, processing policy or quotas. Realtime delivery rechecks the credential after waits.

For delegated personal access, register a public client with an operator. Use Authorization Code with S256 PKCE, an exact registered redirect URI, random state and explicit browser consent. Discover protocol URLs at https://bibleit.app/.well-known/oauth-authorization-server. OAuth endpoints live on https://bibleit.app/oauth, outside the REST API hostname; consent uses a browser session.

Validate redirect state and issuer, exchange the single-use code with its original PKCE verifier, and store rotating tokens atomically. offline_access enables refresh tokens. Code or refresh replay revokes the grant family: never retry an ambiguous exchange as though it were an idempotent resource creation. There is no implicit grant, password grant, client-credentials grant, dynamic registration or OIDC profile in this initial implementation.

A person can inspect and revoke connected clients at /settings/connected-apps and through their authenticated grant-management resources. Client applications must obtain new consent after revocation or grant expiry.

Use the authorization endpoint and token exchange reference for request fields and PKCE requirements. Operator registration instructions remain in the repository at docs/reference/oauth.md.