Authentication

DegenFeed uses OAuth 2.0 for API authentication, compatible with the Mastodon API auth flow.

Creating an Application

Before you can authenticate users, register your application:

curl -X POST https://social.degenfeed.xyz/api/v1/apps \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "My App",
    "redirect_uris": "urn:ietf:wg:oauth:2.0:oob",
    "scopes": "read write follow push",
    "website": "https://myapp.example.com"
  }'

Response:

{
  "id": "12345",
  "name": "My App",
  "client_id": "abc123...",
  "client_secret": "def456..."
}

caution

Store the client_id and client_secret securely. The client_secret is shown only once.

Authorization Code Flow

Step 1: Authorize the User

Direct the user to:

https://social.degenfeed.xyz/oauth/authorize?
  client_id=YOUR_CLIENT_ID&
  redirect_uri=urn:ietf:wg:oauth:2.0:oob&
  response_type=code&
  scope=read+write+follow+push

The user will be prompted to log in and authorize your application.

Step 2: Exchange Code for Token

curl -X POST https://social.degenfeed.xyz/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "redirect_uri": "urn:ietf:wg:oauth:2.0:oob",
    "grant_type": "authorization_code",
    "code": "USER_AUTH_CODE",
    "scope": "read write follow push"
  }'

Response:

{
  "access_token": "ZA-Yj3aBD8U8Cm7lKUpTPiu8aH...",
  "token_type": "Bearer",
  "scope": "read write follow push",
  "created_at": 1687392000
}

Using the Token

Include the token in all API requests:

curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  https://social.degenfeed.xyz/api/v1/accounts/verify_credentials

Scopes

Scope	Description
read	Read timeline, accounts, posts
write	Post, reply, boost, favorite
follow	Follow/unfollow accounts
push	Receive push notifications
admin:read	Read admin data (admin only)
admin:write	Admin actions (admin only)

Token Management

• Access tokens do not expire by default
• Revoke tokens via Settings → Applications or POST /oauth/revoke
• Rotate tokens periodically for security

note

For testing, you can generate a token at Settings → Development in your DegenFeed account.