User-related API environment

Production user-related API docs

These pages describe the Production user-related API stack.

Use production OAuth credentials, production API base URLs, and production app URLs when following this documentation.

Need to test before going live? Switch to the Pre-live docs using the environment switcher above.

Get a CSRF token for authenticated user actions

Issues a request token bound to the authenticated browser session. Fetch it with credentials enabled immediately before a Connected Apps lifecycle action, retain the _csrf cookie from this response, and send the JSON token in the X-CSRF-Token header with the retained cookies.

Responses

• 200
• 401
• 503

---

A non-cacheable CSRF token for the current authenticated browser session.

Response Headers

• Cache-Control string
  Example: private, no-store

  Prevents browsers and intermediaries from caching the token response.

• Set-Cookie string
  Example: _csrf=OPAQUE_SECRET; Path=/; SameSite=Lax

  Sets the opaque _csrf secret cookie required with the X-CSRF-Token header. Retain it for the lifecycle request.

application/json

Schema

Example (from schema)

Example

---

Schema

success boolean required

Possible values: [true]

data object required
csrfToken string required

{
  "success": true,
  "data": {
    "csrfToken": "string"
  }
}

{
  "success": true,
  "data": {
    "csrfToken": "string"
  }
}

A valid Quran.com user session is required.

Session ban-status verification is temporarily unavailable.

application/json

Schema

Example (from schema)

App State authentication unavailable

---

Schema

success boolean required

Possible values: [false]

error object required
code string required
message string required
details object
property name* any

{
  "success": false,
  "error": {
    "code": "string",
    "message": "string",
    "details": {}
  }
}

{
  "success": false,
  "error": {
    "code": "app_state_unavailable",
    "message": "App State authentication is temporarily unavailable."
  }
}

Loading...