| API versioning | All endpoints are under /v1 |
| Identity ID | <handle>@pid (e.g. ifal@pid) — permanent, never changes, never reused |
| Login credentials | (provider, providerUserId) is unique; a non-null email is unique per account |
| Authentication | HttpOnly cookies (JWT access token + rotating refresh token) |
| Access token lifetime | 15 minutes |
| Refresh token lifetime | 30 days (rotated on every use) |
| Wallet | One per PID; Solana smart account + EVM counterfactuals; no key material |
| Fiat balance | Internal IDR ledger per identity; money in via DOKU Checkout |
| Fees | Global 0.1% (min Rp100, no cap) + optional per-app fee (stacks) |
| Machine auth | POST /v1/auth/token (client credentials) for app backends |
| Spec | OpenAPI 3.0 — also served by the API at GET /v1/openapi.yaml |