Authentication

v1 is client_id plus client_secret on every protected GET. A browser session is not enough. Google sign-in is for the website only — do not send a session cookie to v1.

Client credentials

Create or rotate credentials on Account (/account). The secret is shown once.

HTTP Basic — Authorization: Basic base64(client_id:client_secret)
Headers — X-Client-Id and X-Client-Secret

Open Account to create or rotate a secret. The plaintext secret is shown once.

Example request

curl -sS -u "$CLIENT_ID:$CLIENT_SECRET" \
  https://barquant.dev/api/v1/families

curl -sS \
  -H "X-Client-Id: $CLIENT_ID" \
  -H "X-Client-Secret: $CLIENT_SECRET" \
  https://barquant.dev/api/v1/families

401 Unauthorized

Missing or wrong credentials return 401:

{
  "error": "Unauthorized"
}

Cross-origin access is off by default. First-party browser apps only see CORS headers when their origin is allowlisted.