Account API

Create an account and its tenant

Signup is open self-serve, with no email verification. The email is trimmed and lowercased and must contain exactly one @. The password must be 12 to 256 bytes. Anything else is a 400. The call creates a new tenant (acct_…) owned by the account and logs you straight in, returning the same 30-day as_ session that login returns. Limited to 20 signups a minute per client IP and 400 a minute across all callers. Past that the answer is 429 rate_limited with Retry-After.

signup captured live

Request

curl -X POST https://api.ollacore.com/v1/account/signup \
  -H "Content-Type: application/json" \
  -d '{"email":"dev@example.com","password":"<redacted>"}'

{
  "email": "dev@example.com",
  "password": "<redacted>"
}

Request fields

Response · 200

{
  "tenant_id": "acct_fac91b282191cc02dd29912c8db43f1c",
  "session_token": "as_EXAMPLE_SESSION",
  "expires_at": "2026-02-14T09:30:00Z"
}

Log in

Each successful login creates a new, independent session valid for 30 days. Sessions from earlier logins keep working until they expire or are logged out. A wrong password and an unknown email get the same 401. An email that is not shaped like an address gets 400 before any lookup. Limited to 30 attempts a minute per client IP and 600 a minute across all callers (429 rate_limited with Retry-After).

login captured live

Request

curl -X POST https://api.ollacore.com/v1/account/login \
  -H "Content-Type: application/json" \
  -d '{"email":"dev@example.com","password":"<redacted>"}'

{
  "email": "dev@example.com",
  "password": "<redacted>"
}

Request fields

Response · 200

{
  "tenant_id": "acct_fac91b282191cc02dd29912c8db43f1c",
  "session_token": "as_EXAMPLE_SESSION",
  "expires_at": "2026-02-14T09:30:01Z"
}

Invalidate the session

Deletes only the session in the Authorization header. The account's other sessions and its API keys are untouched. Afterwards that token answers 401 everywhere, including on a repeated logout.

logout captured live

Request

curl -X POST https://api.ollacore.com/v1/account/logout \
  -H "Authorization: Bearer as_…" \
  -H "Content-Type: application/json" \
  -d '{}'

{}

Response · 200

{
  "logged_out": true
}

List keys

Returns every key the account has minted, live and test, newest first. Revoked keys are included, with revoked_at set. Each entry carries id, name, environment, plan, scopes, created_at, last_used_at, revoked_at and expires_at. There is no pagination.

listKeys captured live

Request

curl -X GET https://api.ollacore.com/v1/account/api-keys \
  -H "Authorization: Bearer as_…"

Response · 200

{
  "api_keys": [
    {
      "created_at": "2026-01-15T09:30:01Z",
      "environment": "live",
      "expires_at": null,
      "id": "key-id-main",
      "last_used_at": null,
      "name": "docs-example-key",
      "plan": "default",
      "revoked_at": null,
      "scopes": [
        "rooms:read",
        "rooms:write",
        "members:write",
        "tokens:mint",
        "messages:write",
        "webhooks:manage",
        "usage:read",
        "rooms:delete",
        "data:erase"
      ]
    }
  ]
}

Create a key (secret shown once)

environment must be live or test. A test key works in a separate sandbox namespace of your tenant and never sees live rooms, messages or usage. Omit scopes for the default set (rooms:read, rooms:write, members:write, tokens:mint, messages:write). You may also request webhooks:manage, usage:read, rooms:delete and data:erase. Any other scope name, or any other environment, is a 400. Keys made here are on the default plan and do not expire. Only a hash of the secret is stored, so api_key appears in this response and nowhere else.

createKey captured live

Request

curl -X POST https://api.ollacore.com/v1/account/api-keys \
  -H "Authorization: Bearer as_…" \
  -H "Content-Type: application/json" \
  -d '{"name":"docs-example-key","environment":"live","scopes":["rooms:read","rooms:write","members:write","tokens:mint","messages:write","webhooks:manage","usage:read","rooms:delete","data:erase"]}'

{
  "name": "docs-example-key",
  "environment": "live",
  "scopes": [
    "rooms:read",
    "rooms:write",
    "members:write",
    "tokens:mint",
    "messages:write",
    "webhooks:manage",
    "usage:read",
    "rooms:delete",
    "data:erase"
  ]
}

Request fields

Response · 200

{
  "key_id": "key-id-main",
  "api_key": "ak_live_EXAMPLE.NOT_A_REAL_KEY",
  "environment": "live",
  "scopes": [
    "rooms:read",
    "rooms:write",
    "members:write",
    "tokens:mint",
    "messages:write",
    "webhooks:manage",
    "usage:read",
    "rooms:delete",
    "data:erase"
  ]
}

Rotate atomically

In one transaction, mints a replacement that carries the old key's name, environment, scopes, plan and expiry, and revokes the old key. The old secret is refused from its next request. Session tokens already minted with the old key stay valid until they expire. Not idempotent: if the response is lost, a retry gets 404 because the old key is already revoked. The replacement still exists and shows in GET /v1/account/api-keys, but its secret cannot be shown again, so revoke it and create a new key.

rotateKey captured live

Request

curl -X POST https://api.ollacore.com/v1/account/api-keys/key-id-main/rotate \
  -H "Authorization: Bearer as_…" \
  -H "Content-Type: application/json" \
  -d '{}'

{}

Response · 200

{
  "api_key": "ak_live_EXAMPLE.NOT_A_REAL_KEY",
  "key_id": "ak_live_616b8de93a24dfbf2c5839186fd5b29a"
}

Revoke

Sets the key's revoked_at. The key stays in the key list with that timestamp. The key's row is read on every request, so the next request made with this key gets 401. Session tokens it already minted stay valid until they expire. Revoking a key that is already revoked answers 404, which a retry can treat as done.

deleteKey captured live

Request

curl -X DELETE https://api.ollacore.com/v1/account/api-keys/ak_live_e8177c7859fe3139043b58fff01924bd \
  -H "Authorization: Bearer as_…"

Response · 200

{
  "revoked": true
}

Provision an app (webhook or SMS provider)

Set exactly one of delivery_webhook_url or provider. In webhook mode the response carries delivery_secret, shown only here. Each OTP is POSTed to your URL as JSON {app_id, phone, code, expires_at} with an x-ollacore-signature: t=<unix seconds>,v1=<hex> header, where v1 is HMAC-SHA256 of <t>.<body> keyed with that secret. The URL is checked again on every delivery. In provider mode provider.kind is twilio, plivo or msg91. provider.config is checked for that vendor now, so a misconfiguration fails here rather than when a user asks for a code.

createDirectoryApp captured live

Request

curl -X POST https://api.ollacore.com/v1/account/directory-apps \
  -H "Authorization: Bearer as_…" \
  -H "Content-Type: application/json" \
  -d '{"delivery_webhook_url":"https://hooks.example.com/hook"}'

{
  "delivery_webhook_url": "https://hooks.example.com/hook"
}

Request fields

Response · 200

{
  "app_id": "da_03270a6c821fcca6c63a2049d93b62fe",
  "delivery_mode": "webhook",
  "delivery_secret": "dsec_EXAMPLE_NOT_A_REAL_SECRET",
  "delivery_webhook_url": "https://hooks.example.com/hook"
}

List apps and which push transports are configured

Newest first. Each entry has app_id, delivery_mode, delivery_webhook_url (webhook mode only) and created_at. It also has push_fcm and push_apns, which say whether native-push credentials are stored. The delivery secret, SMS-provider credentials and push credentials are never returned.

listDirectoryApps captured live

Request

curl -X GET https://api.ollacore.com/v1/account/directory-apps \
  -H "Authorization: Bearer as_…"

Response · 200

{
  "directory_apps": [
    {
      "app_id": "da_03270a6c821fcca6c63a2049d93b62fe",
      "created_at": "2026-01-15T09:30:01Z",
      "delivery_mode": "webhook",
      "delivery_webhook_url": "https://hooks.example.com/hook",
      "push_apns": false,
      "push_fcm": false
    }
  ]
}

Delete an app

The app_id stops working at once: otp/request and otp/verify answer 404 for it. Users belong to the tenant, not the app, so users, conversations and existing du_ sessions stay. Push tokens registered under the deleted app use the credentials of the tenant's only remaining directory app. They get no native push if the tenant has no other app or more than one.

deleteDirectoryApp captured live

Request

curl -X DELETE https://api.ollacore.com/v1/account/directory-apps/da_03270a6c821fcca6c63a2049d93b62fe \
  -H "Authorization: Bearer as_…"

Response · 200

{
  "deleted": true
}

Set FCM/APNs credentials (write-only)

Replaces both sides: an omitted or null fcm or apns clears what was stored, so send both to keep both. fcm.service_account needs project_id, client_email and private_key. A token_uri, if present, must be https://oauth2.googleapis.com/token. apns needs a PEM p8, key_id, team_id and topic (the bundle id), with env set to sandbox or production (default production). Credentials are validated here and are write-only: no call returns them. They sign pushes to the fcm and apns tokens registered under this app.

setPush captured live placeholder credentials

Request

curl -X PUT https://api.ollacore.com/v1/account/directory-apps/da_03270a6c821fcca6c63a2049d93b62fe/push \
  -H "Authorization: Bearer as_…" \
  -H "Content-Type: application/json" \
  -d '{"fcm":{"service_account":{"project_id":"my-firebase-project","client_email":"push@my-firebase-project.iam.gserviceaccount.com","private_key":"-----BEGIN PRIVATE KEY-----\n<redacted>\n-----END PRIVATE KEY-----"}},"apns":{"p8":"-----BEGIN PRIVATE KEY-----\n<redacted>\n-----END PRIVATE KEY-----","key_id":"ABC123DEFG","team_id":"TEAM123456","topic":"com.example.chat","env":"production"}}'

{
  "fcm": {
    "service_account": {
      "project_id": "my-firebase-project",
      "client_email": "push@my-firebase-project.iam.gserviceaccount.com",
      "private_key": "-----BEGIN PRIVATE KEY-----\n<redacted>\n-----END PRIVATE KEY-----"
    }
  },
  "apns": {
    "p8": "-----BEGIN PRIVATE KEY-----\n<redacted>\n-----END PRIVATE KEY-----",
    "key_id": "ABC123DEFG",
    "team_id": "TEAM123456",
    "topic": "com.example.chat",
    "env": "production"
  }
}

Request fields

Response · 200

{
  "push_apns": true,
  "push_fcm": true
}