User-related API environment
Pre-live user-related API docs
These pages describe the Pre-live user-related API stack.
Use pre-live OAuth credentials, pre-live API base URLs, and pre-live app URLs when following this documentation. Keep your OAuth flow, API requests, callback URLs, and manual testing within the pre-live environment.
- Use prelive.quran.com for auth-related testing.
- Use prelive.quranreflect.org for Quran Reflect paths where applicable.
- Do not mix production sessions or production user data with pre-live testing.
User-related APIs
Quran.Foundation user-related APIs enable your app to seamlessly integrate with Quran.Foundation's user-centric features, providing access to personalized notes, bookmarks, goals, streaks, reading sessions, and more. This differentiates them from content APIs that focus on non-user-specific resources like translations, tafsirs, and verses.
How to get access
We are using OAuth2 flows to authenticate and authorize requests. To get started, you need to get an access token to make requests to our APIs. Then follow the steps mentioned here.
For web applications, the recommended integration pattern is backend token exchange plus backend or server-side proxy calls to User APIs. Your app can keep the user session in secure server storage or httpOnly cookies, while your backend injects x-auth-token and x-client-id on outbound requests to Quran.Foundation APIs.
Pagination
We are using cursor based pagination. The pagination query params consist of first,after, before and last.
Example
first: 10will give you first 10 itemsfirst: 10, after: xyzwill give you first 10 items after the item with idxyzlast: 10will give you the last 10 itemslast: 10, before: xyzwill give you the last 10 items before the item with idxyzThe only possible combinations are
first + afterorlast + before. They should not be used together
Authentication
The JWT access token required for accessing the endpoints.
| Security Scheme Type: | apiKey |
|---|---|
| Header parameter name: | x-auth-token |
Your client id
| Security Scheme Type: | apiKey |
|---|---|
| Header parameter name: | x-client-id |