Skip to main content
The Denialbase API is organized around REST. Requests accept JSON-encoded bodies, return JSON-encoded responses, and use standard HTTP status codes, authentication, and verbs.

​
Base URL

​
Authentication

Denialbase uses httpOnly cookie-based JWT authentication. See Authentication for the full flow.
Never use localStorage or Bearer tokens from client-side JavaScript — all session cookies are httpOnly and Secure. If you need programmatic access outside a browser, see API tokens.

​
Supported authentication factors

  • Password (12+ chars, zxcvbn score ≥ 3)
  • TOTP (RFC 6238)
  • Passkeys (WebAuthn / FIDO2)
  • Magic links (email-based, short TTL)
  • Google OAuth 2.1

​
Rate limits

Rate limits are enforced by Rack::Attack backed by Memorystore Redis and return 429 Too Many Requests with a Retry-After header. See Rate Limits for more detail.

​
Versioning

The API is versioned via URL prefix (/api/v1). Breaking changes ship as a new version; non-breaking additions (new fields, new endpoints) are added to the current version without a new URL.

​
SDKs

We don’t publish official SDKs yet. The OpenAPI spec is available at openapi.yaml — use it to generate a client in your language of choice.

​
Errors

Denialbase uses conventional HTTP response codes: