Skip to main content
JotifySearch people, posts, videos and communities
HomeWatchCommunitiesMeetApps
Account
Welcome to JotifySign in or create an account
Log inContinue to your accountCreate accountJoin Jotify
Appearance · system
J
Welcome to JotifyExplore as guest

Build on Jotify

Jotify AppsDevelopersAPI docs

Explore

HomeCreateSearchWatchShortsCommunitiesForumEventsReviewsClassifiedsReconnectMeet
All documentation
Getting startedJotify CLIOAuth and user consentAPI referenceWebhooksApp surfaces and scopes

Authorization Code + PKCE

OAuth and user consent

Request user-approved scopes without exposing app or user credentials to browser and mobile clients.

Register an exact callback

Add each HTTPS redirect URI in Developer Console. Jotify compares the complete callback string and does not allow wildcard hosts, fragments or production HTTP.

  • Keep development and production callbacks separate.
  • Never place tokens in the redirect URI.
  • Rotate the app secret if it is exposed.

Authorize with PKCE S256

Create a high-entropy verifier, send only its SHA-256 base64url challenge, show the user the exact requested scopes and require explicit consent.

Jotify

Jotify and Jotify Chat are in pre-launch. See verified availability before downloading.

Mobile appsTermsPrivacyCookiesSafety
Coming toGoogle PlayComing to theApp Store
Friends creating and connecting together on a rooftopJoin Jotify
Your place is ready

Create, connect and join in.

Save videos, follow creators and take part in communities, events and conversations.

Create account Log in
HomeWatchCreateMeetInbox
POST /api/app-platform/oauth/authorize

{ "clientId": "jotify_…", "redirectUri": "https://app.example.com/oauth/callback", "scope": "profile:read", "state": "opaque-csrf-value", "codeChallenge": "base64url-sha256", "codeChallengeMethod": "S256", "consent": true }

Exchange and rotate

Exchange the single-use five-minute code from your backend with the original verifier and app secret. Access tokens last one hour; refresh tokens last 30 days and rotate on every refresh.

POST /api/app-platform/oauth/token

{ "grantType": "authorization_code", "clientId": "jotify_…", "clientSecret": "server-only-secret", "code": "single-use-code", "redirectUri": "https://app.example.com/oauth/callback", "codeVerifier": "original-verifier" }

Revocation

A user grant or app token can be revoked without exposing stored token values. Jotify stores token hashes only and fails closed when the app, grant or token is inactive.

GET  /api/app-platform/oauth/me
POST /api/app-platform/oauth/revoke
Next: API reference