Register a third-party app
curl --request POST \
--url https://api.pid.peridotvault.com/v1/apps \
--header 'Content-Type: application/json' \
--cookie pid_access= \
--data '
{
"name": "My Game"
}
'const options = {
method: 'POST',
headers: {cookie: 'pid_access=', 'Content-Type': 'application/json'},
body: JSON.stringify({name: 'My Game'})
};
fetch('https://api.pid.peridotvault.com/v1/apps', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.pid.peridotvault.com/v1/apps"
payload = { "name": "My Game" }
headers = {
"cookie": "pid_access=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.pid.peridotvault.com/v1/apps"
payload := strings.NewReader("{\n \"name\": \"My Game\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "pid_access=")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"clientId": "pidapp_0123456789abcdef0123456789abcdef",
"ownerId": "<string>",
"name": "<string>",
"allowedOrigins": [
"<string>"
],
"isActive": true,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"clientSecretPrefix": "<string>",
"clientSecretCreatedAt": "2023-11-07T05:31:56Z"
}{
"statusCode": 400,
"message": [
"handle must be 3-20 chars: lowercase letters, numbers, underscore"
]
}{
"statusCode": 401,
"message": "Unauthorized"
}apps
Register a third-party app
Registers an app for “Sign in with PeridotID” and returns its public
client_id. Pass just a name — allowed origins are managed after via
PATCH (the exact return URL is passed in code at login time).
Authenticated — the caller becomes the app owner.
POST
/
apps
Register a third-party app
curl --request POST \
--url https://api.pid.peridotvault.com/v1/apps \
--header 'Content-Type: application/json' \
--cookie pid_access= \
--data '
{
"name": "My Game"
}
'const options = {
method: 'POST',
headers: {cookie: 'pid_access=', 'Content-Type': 'application/json'},
body: JSON.stringify({name: 'My Game'})
};
fetch('https://api.pid.peridotvault.com/v1/apps', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.pid.peridotvault.com/v1/apps"
payload = { "name": "My Game" }
headers = {
"cookie": "pid_access=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.pid.peridotvault.com/v1/apps"
payload := strings.NewReader("{\n \"name\": \"My Game\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "pid_access=")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"clientId": "pidapp_0123456789abcdef0123456789abcdef",
"ownerId": "<string>",
"name": "<string>",
"allowedOrigins": [
"<string>"
],
"isActive": true,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"clientSecretPrefix": "<string>",
"clientSecretCreatedAt": "2023-11-07T05:31:56Z"
}{
"statusCode": 400,
"message": [
"handle must be 3-20 chars: lowercase letters, numbers, underscore"
]
}{
"statusCode": 401,
"message": "Unauthorized"
}Authorizations
JWT access token set by /auth/google/callback or /auth/refresh
Body
application/json
Response
The registered app including its client_id
Public app id to pass as clientId in login/exchange calls
Example:
"pidapp_0123456789abcdef0123456789abcdef"
Managed list of bare origins — login redirects and CORS
Identifying prefix of the current backend secret (the secret itself is never returned)