UnlockBin API

Routes chipped Public work with no authentication at all. Routes chipped Auth required need a Firebase ID token, sent as:

Authorization: Bearer <Firebase ID token>

This API does not issue that token itself - there is no login route here. Sign-in happens directly against Firebase Authentication, then you send us the token it gives you.

Email/password accounts can get one with a single request, using this project's Firebase Web API key:

POST https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=AIzaSyBrv13uRr4W-FtRdxv-3sRFN0dzseZAO7c
Content-Type: application/json

{"email": "you@example.com", "password": "yourpassword", "returnSecureToken": true}

The response's idToken field is what you send as the Bearer token. It expires after 1 hour; exchange the response's refreshToken for a new one without asking for the password again:

POST https://securetoken.googleapis.com/v1/token?key=AIzaSyBrv13uRr4W-FtRdxv-3sRFN0dzseZAO7c
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token&refresh_token=YOUR_REFRESH_TOKEN

Google/GitHub accounts can't sign in with a single REST call (it's a redirect/popup flow) - use a Firebase Client SDK (JS, Android, iOS) configured for this project to complete sign-in, then call its user.getIdToken() to get the Bearer token.

Without a valid token, an auth-required route returns 401.