Ollacore
Documentation

Build a messenger on Ollacore

Ollacore gives you the server half of a chat and calling product: durable ordered messaging, an SFU for multi-party audio/video, end-to-end-encryption transport, push, and optional turnkey phone-OTP identity. You build the clients.

In a hurry? The integration checklist is the exact endpoint-and-frame sequence to get chat, a call and push working — start there and refer back to these pages for detail.

Orientation #

Three things explain most of the design:

  1. A room is the only primitive. Direct messages and groups are both rooms; calls happen in rooms; permissions are per-room. There is no separate "conversation" object.
  2. Tokens are room-scoped and short-lived. A client credential authorises one principal, in one room, for minutes — not blanket account access. Minting them is a server-side (or directory) operation.
  3. Durability comes before delivery. A message is committed to PostgreSQL and assigned a monotonic per-room sequence before it is fanned out, which is what makes gap-free reconnection possible.

Where to go #

START

Quickstart

From a fresh account to a message delivered over a socket, with curl.

START

Integration checklist

The full ordered sequence for chat, calls and push — plus what to verify before shipping.

CONCEPT

Architecture

What runs, what stores state, and how an event travels from send to every device.

CONCEPT

Authentication planes

Five credential types, what each may touch, and which ones must never reach a client.

BUILD

Chat

Sending, editing, reactions, receipts, unread, search, history and catch-up.

BUILD

Audio & video

SFU signalling, trickle ICE, re-offers, screen share, multi-device, and call events.

BUILD

Push & ringing

Web Push, native FCM/APNs with your own credentials, and how offline devices get rung.

BUILD

Turnkey identity

Phone-OTP signup, contacts, conversations and the inbox — a messenger without an app-server.

REFERENCE

WebSocket protocol

Every client and server frame on both sockets, with exact field names.

REFERENCE

API reference

All 81 HTTP operations grouped by plane, with the credential each one takes.

Conventions #

  • All endpoints are versioned under /v1. The contract is additive-only, with a 90-day deprecation notice signalled by Deprecation and Sunset headers.
  • Identifiers are UUIDs unless stated. principal_id is an opaque string you choose (or, on the directory path, the directory user's UUID).
  • Errors are a JSON object with code and message — see Errors & rate limits.
  • Timestamps are RFC 3339 UTC.
  • Machine-readable contracts: OpenAPI for HTTP, AsyncAPI plus a JSON-Schema bundle for the sockets. Both are kept in lockstep with the router by a parity check that fails the build.