Login & Authentication¶

Public browsing operations have no authentication requirement declared. User operations require an HTTP bearer access token.

Authorization: Bearer YOUR_ACCESS_TOKEN

Both JWTAuth and JWTAuthAsync are HTTP bearer security schemes in the specification. They use the same header format.

Device Login¶

The documented exchange requires device_code in the query string, even though the request method is POST. The token response contains access_token and token_type.

The specification does not explain how codes are issued, user approval, polling intervals, token expiry, refresh or revocation. Do not assume this endpoint alone defines a complete OAuth device flow. Obtain the missing steps from the service operator.

Exchange Example¶

Replace the placeholder with a valid code. This request obtains credentials; avoid logging the URL or response.

curl --fail-with-body --request POST \
  "https://galleryapi.dabbble.app/v1/login/device_login?device_code=YOUR_DEVICE_CODE"

const code = process.env.ICOSA_DEVICE_CODE;
if (!code) throw new Error('Set ICOSA_DEVICE_CODE');
const url = new URL('https://galleryapi.dabbble.app/v1/login/device_login');
url.searchParams.set('device_code', code);
const response = await fetch(url, {
  method: 'POST', signal: AbortSignal.timeout(20000)
});
if (!response.ok) throw new Error(`HTTP ${response.status}`);
const result = await response.json();
// Store result.access_token securely; do not print it to logs.

import json
import os
from urllib.parse import urlencode
from urllib.request import Request, urlopen
url = 'https://galleryapi.dabbble.app/v1/login/device_login?' + urlencode({
    'device_code': os.environ['ICOSA_DEVICE_CODE']
})
with urlopen(Request(url, method='POST'), timeout=20) as response:
    result = json.load(response)
# Store result['access_token'] securely; do not print it to logs.

Endpoint Reference¶

POST /v1/login/device_login¶

Device Login

Authentication: No security requirement declared.

Response Schema¶

LoginToken¶

Token Safety¶

Keep tokens out of URLs, public repositories and frontend bundles. Use environment variables or a secret store for server-side examples. Do not infer that tokens never expire just because expiry fields are absent from the schema.