HTTP and messages — reference
GET / POST = HTTP requests (URL + method + optional JSON body + status code).
postMessage = browser-only message from the iframe to your page — not an HTTP call.
| Call | Who | Where | Typical result |
|---|---|---|---|
GET /api/me |
Your page (fetch) |
Your servershop.example.com |
200 + { profile } if cookie valid;401 if not signed in.
|
GET /api/config |
Your page (fetch) |
Your server |
200 + { authOrigin, profileFields, … } — no app uuid.
|
GET /api/auth/embed |
kie-la-auth.js |
Your server |
200 + { url } — full iframe URL on the auth server
(app name/uuid added server-side).
|
POST /api/verify |
Iframe login page (fetch) |
Auth serverauth.kie.la |
200 + { exchange, … } after passcode + PIN OK;4xx + error message if wrong code/PIN.
|
postMessage |
Iframe → your page | Browser only |
Resize events; finally { exchange } after verify succeeds.
Not visible in DevTools Network as an HTTP row — check the Console / Messages panel.
|
POST /api/session |
kie-la-auth.js |
Your server |
200 + { ok: true, profile } and Set-Cookie for session;4xx if exchange invalid or expired.
|