API and API keys

nia-todo exposes a JSON API below /api. The web and native clients use the same API.

Create an API key

Create and revoke personal API keys from the user settings. When MFA is required, key management requires a fresh reauthentication step.

Send the key in the Authorization header:

curl https://todo.example.com/api/me \
  -H 'Authorization: ApiKey nt_REPLACE_WITH_YOUR_KEY'

Do not pass keys in query strings. Keep them in environment variables or a secret manager, and avoid printing them in CI logs.

Browser sessions

Interactive clients can authenticate through POST /api/login. Login can return either an access token or an MFA challenge. Browser mutations also use CSRF protection, so API keys are usually simpler for automation.

Main resources

The API includes resources for:

• todos, subtasks, comments and attachments
• projects, sections and workspaces
• reminders and places
• sharing and invitations
• profile, sessions, passkeys and 2FA
• admin configuration and users

The public instance-discovery endpoint is useful for connectivity checks:

curl https://todo.example.com/api/instance

Endpoint reference

The detailed endpoint and payload reference currently lives beside the backend source in docs/api.md on GitHub. It is intentionally kept there because it changes together with API implementation and tests.

There is no stability guarantee for undocumented internal endpoints. Pin the server release used by production integrations and review the changelog before upgrading.