Developers
Developer documentation
Everything you need to authenticate users with Authly and sync their vault. Free to read — no account required.
Preview
What your users see when they sign in with Authly.
AuthlyYour App wants to access your Authly account
- Verify who you are
- Read your profile name and email
- Read your encrypted accounts
Secrets never leave your device unencrypted.
Preview only — the live screen shows your application name, logo and requested scopes.
Quickstart
Authorization code flow with PKCE, in four steps.
1. build the authorize URL
const verifier = crypto.randomUUID() + crypto.randomUUID();const challenge = base64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));const url = new URL("https://authly.lovable.app/oauth/authorize");url.searchParams.set("client_id", CLIENT_ID);url.searchParams.set("redirect_uri", "myapp://callback");url.searchParams.set("response_type", "code");url.searchParams.set("scope", "openid profile accounts.read");url.searchParams.set("code_challenge", challenge);url.searchParams.set("code_challenge_method", "S256");2. exchange the code
const res = await fetch("https://authly.lovable.app/api/public/oauth/token", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ grant_type: "authorization_code", code, client_id: CLIENT_ID, code_verifier: verifier, redirect_uri: "myapp://callback", }),});const { access_token, refresh_token, expires_in } = await res.json();3. call the API
const accounts = await fetch("https://authly.lovable.app/api/public/v1/accounts", { headers: { authorization: `Bearer ${access_token}` },}).then((r) => r.json());4. verify a webhook
// signature = HMAC-SHA256(secret, rawBody), hex encodedconst expected = hmacSha256Hex(process.env.AUTHLY_WEBHOOK_SECRET, rawBody);if (expected !== request.headers.get("x-authly-signature")) return new Response("bad signature", { status: 401 });API reference
Base URL https://authly.lovable.app
GET
/api/public/oauth/discoveryOpenID configuration and supported scopesGET
/oauth/authorizeAuthorization screen (PKCE, S256 required)POST
/api/public/oauth/tokenExchange code or refresh tokenGET
/api/public/oauth/userinfoProfile of the authenticated userPOST
/api/public/oauth/revokeRevoke an access or refresh tokenGET
/api/public/v1/accountsEncrypted TOTP account payloadsGET
/api/public/v1/devicesList and revoke connected devicesChangelog
Platform updates.
Developer Hub
- Applications, API keys, webhooks, analytics and logs in one workspace.
OAuth 2.1
- PKCE-only authorization code flow with refresh-token rotation.
Sync API
- Zero-knowledge account payloads — secrets stay encrypted client-side.