Authentication

DYOGG saat ini mendukung 1 mekanisme auth: Bearer API Key. OAuth2 authorization code flow dijadwalkan Q3 2026 untuk aplikasi third-party yang mengakses data user login.

Bearer API Key

Kirim header Authorization: Bearer <API_KEY> di semua request.

curl "https://api.dyogg.com/v1/player/genshin/816973814" \
  -H "Authorization: Bearer dyo_live_9f8a2c1b..."

Format key

Prefix	Environment	Traffic
`dyo_test_`	Sandbox / test	Data mock, rate limit sama, dashboard analytics terpisah
`dyo_live_`	Production	Data real dari upstream

Scope

Scope	Endpoint yang diakses
`read`	Semua `GET /*` (Player, Character, Weapon, Archive, TrustScore, Assets, Leaderboard).
`write:report`	`POST /v1/scam-report`
`write:build`	`POST /v1/build-analyzer/save`, `POST /v1/damage-calculator/save`
`admin`	Reserved — hanya untuk DYO staff internal, tidak issued ke public.

Scope disatukan di 1 key — kamu bisa combine mis. read + write:report. Best practice: buat 1 key per scope minimum agar blast radius kecil kalau leaked.

Rotasi key

curl -X POST "https://api.dyogg.com/v1/keys/rotate" \
  -H "Authorization: Bearer dyo_live_OLD_KEY" \
  -d '{"revoke_old_in_seconds": 3600}'

Response berisi new key. Key lama tetap valid selama revoke_old_in_seconds (max 24 jam) untuk graceful deploy.

OAuth2 (roadmap Q3 2026)

Draft flow:

User klik "Sign in with DYOGG" di aplikasi third-party.
Redirect ke https://dyogg.com/oauth/authorize?client_id=…&scope=read+write:build.
User approve → redirect back dengan code.
Aplikasi exchange code → access_token (JWT, expires 1 jam) + refresh_token.
Aplikasi memanggil /v1/* dengan Authorization: Bearer <access_token>.

Ikuti Changelog untuk update rilis.

Keamanan

Jangan expose key di client-side. Frontend HARUS proxy via backend sendiri.
Kalau leaked, langsung rotate di dashboard atau via POST /v1/keys/revoke.
IP allowlist tersedia via dashboard (opsional) — batasi key hanya dari IP tertentu.
Encrypt-at-rest: kami hash key dengan bcrypt cost 12 di database; hanya bagian prefix disimpan plaintext untuk lookup log.

FAQ singkat

Q: Bisa pakai X-Api-Key header? A: Belum. Bearer sesuai standar OpenAPI 3.1 → tools generator langsung compatible.

Q: Cookie auth? A: Tidak. API kami stateless — tidak set/pakai cookie.