openapi: 3.1.0
info:
  title: Manifold OAuth2 Authentication Authorization Code Grant Signature Grant API
  description: 'Server-side session authentication API for validating wallet addresses of authenticated Manifold clients. Supports two grant types: Signature Grant (POST /verify to confirm a wallet signature session token) and Authorization Code Grant (POST /token to exchange a one-time code for a 30-day access token). Enables backends to securely access and modify private user data without exposing session keys client-side. Requires a Developer App configured at the Manifold Developer Portal.'
  version: 1.0.0
  contact:
    name: Manifold
    url: https://manifold.xyz
  license:
    name: MIT
servers:
- url: https://oauth2.manifoldxyz.dev
  description: Manifold OAuth2 Authentication Server
tags:
- name: Signature Grant
  description: Validate a wallet signature session token to confirm a user's wallet address server-side.
paths:
  /verify:
    post:
      operationId: verifySignatureToken
      summary: Verify a Signature Grant session token
      description: Validates a session token obtained from the Manifold frontend client (via the Manifold Ethereum Provider or the `m-authenticated` event). Returns the wallet address associated with the authenticated session.
      tags:
      - Signature Grant
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyRequest'
            example:
              token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
      responses:
        '200':
          description: Token verified successfully; wallet address returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerifyResponse'
              example:
                unwrappedJWT:
                  address: 0xAbCd1234...
        '403':
          description: Token validation failed or wallet address not present in token payload.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    VerifyRequest:
      type: object
      required:
      - token
      properties:
        token:
          type: string
          description: The session token retrieved from the Manifold frontend via the Manifold Ethereum Provider or the `m-authenticated` event.
    VerifyResponse:
      type: object
      properties:
        unwrappedJWT:
          type: object
          properties:
            address:
              type: string
              description: The Ethereum wallet address of the authenticated user.
              example: 0xAbCd1234...
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Machine-readable error code.
        error_description:
          type: string
          description: Human-readable description of the error.