Public API

Creates an account. The username doubles as the referral code.

Whether a username is available. Gates the sign-up button.

Whether an email address is available. ⚠️ Tight limit — this is a user-enumeration surface.

Signs in with username and password, returns an access token.

Issues a single-use nonce for the device account picker (Credential Manager). Valid 5 minutes, bound to the device.

Verifies the Google id_token from the native account picker. Signs in when the account exists. When it does NOT, no account is created — returns `signup_required` with a `pending_token`; the signup finishes via `auth/social-complete`.

Completes a pending social signup with the chosen username and starts a session. The referral code is optional; without it the account is linked to the system account.

Sends a password reset link. Returns the same response whether or not the address is registered, to prevent account enumeration. No code is sent to an account that is linked to a social login and whose address is not verified yet (the response is still the same), so the owner of a mistyped address cannot take the account; the real owner can still sign in with the social login.

Verifies the 6-digit code from the email and returns a short-lived ticket, required by step 3 to set the new password.

Spends the ticket and writes the new password. All of the user's sessions are revoked.

Changes the password. The current password is required. Sessions on other devices are NOT closed.

Rotates the token. Only tokens within 7 days of expiry rotate; the old one is revoked at once.

Takes no parameters.

Revokes this device's token.

Uploads a profile photo (multipart, field name `file`). JPEG/PNG, max 5 MB. The server re-encodes to a 512×512 square and stores it as JPEG.

Removes the profile photo and deletes the file from disk.

Takes no parameters.

Sends a 6-digit verification code to the account email address (the code is also in the subject). No email is sent if the address is already verified. Within 60 seconds of the last code no new code is issued and no email is sent: the response is `sent:false`, `already_sent:true` and `retry_after` (seconds); the code already sent stays valid.

Takes no parameters.

Verifies the 6-digit code from the email and confirms the address.

Profile, balance, current multiplier and open session state.

Takes no parameters.

Updates the display name and email address. ⚠️ Changing the email RESETS verification and sends a 6-digit code to the new address. Once the new address is verified, social sign-in links (Google) that do not match it are removed and a `security` notification is written for the user.

Deletes the account from inside the app. ⚠️ The username must be typed to confirm. The account closes immediately, sessions are revoked and after 30 days the identity is erased irreversibly; until then support can undo it.

Balance ledger: every movement, its amount and the balance at that moment. Cursor pagination (`before_id`) — no row is skipped when new entries arrive.

Starts a social login flow and returns the URL to open in a browser.

Exchanges the handover code from social login for an access token. Single use, valid 60 seconds.

Redirects the flow to the provider (302). Opened in a browser; does not return JSON.

Google callback. THIS IS THE URL TO PASTE INTO THE GOOGLE CONSOLE. Not called by the app.

Published missions and the user's status on each. ⚠️ When the system is off it returns `enabled: false` and an EMPTY list.

Takes no parameters.

Submits an entry for a mission. ⚠️ The reward lands on the balance when an admin APPROVES it, not on submission.

Submits a SCREENSHOT for a mission (multipart). ⚠️ Only missions with `answer_type = image` accept it. The reward lands on the balance when an admin APPROVES it, not on submission.

The user's own support tickets. ⚠️ Message BODIES are not returned, only the header; use `support/thread` for the conversation.

Takes no parameters.

Messages of one ticket. ⚠️ Does NOT mark as read — that is `support/read`. If fetching counted as reading, an app opened and closed on a notification would clear the unread mark unseen.

Returns the attachment (screenshot) of a message as BYTES; only to the ticket owner. Someone else's, missing or attachment-less messages get the SAME `not_found`. The response is `no-store`: it must not be cached or written to disk.

Opens a new support ticket. ⚠️ LINKS ARE REFUSED in the text (it keeps a phishing address from being opened in the admin panel); a screenshot can be attached with `support/reply-image`.

Opens a new support ticket WITH A SCREENSHOT (multipart). Same rules as `support/open`; a body is still required.

Replies to an existing ticket. ⚠️ A `solved` ticket REOPENS — otherwise a "no, it did not work" message would fall outside the queue. A `closed` ticket is refused.

Replies to a ticket with a SCREENSHOT (multipart). ⚠️ A body is still REQUIRED: an image-only message does not tell the person in the admin panel what they are looking at.

Marks admin replies as read.

Starts a session. The multiplier is computed now and frozen onto the session; later changes in referral activity do not alter it.

Takes no parameters.

Remaining time and expected reward of the open session.

Takes no parameters.

Credits a finished session. A session is never credited twice.

Takes no parameters.

People you referred and how many are mining right now. Only active ones count. Cursor pagination (`before_id`), ordered by `id DESC` — `mining_now` is live and stays out of the ordering, otherwise rows would repeat or vanish across pages. `total` and `active` come from their own query, not from the page.

Sends a reminder notification to someone you referred whose mining session is off. Once per 12 hours per target. Only your own referrals can be reached.

Ads watched in the current slice of the running session (the session is split into `slices` equal parts), ads watched across the whole session (`session_watched`, capped by `daily_total`), remaining quota, when the next slice starts and any live boost. Rewards are NOT granted here — Google verifies server-to-server.

Takes no parameters.

Reports the outcome of a rewarded-ad load attempt. Sessions start with an ad, so fill rate is a direct measure of revenue: every unfilled attempt means a session that started without an ad.

Registers the device FCM token. The app must call this on every <code>onNewToken</code>, independently of the login flow. Safe to call repeatedly for the same device.

In-app notification list. Push is not lossless (device off, permission denied, dead token) — this list is the durable record, and the text is stored already resolved to the language used at send time. `type` values: `announcement`, `mining` (session closed and reward credited), `kyc`, `withdrawal`, `wallet`.

Marks a notification read. Without <code>id</code>, marks all of the user's unread notifications.

Deletes a notification. Without <code>id</code>, deletes the user's READ notifications — unread ones are kept, because destroying an unseen notification in one tap would lose something the user never saw.

Startup configuration — which sign-in methods are ENABLED. <b>No auth</b>: social buttons are drawn before sign-in, when no token exists yet. ⚠️ Returns only availability; never a key, app id or secret.

Takes no parameters.

Languages enabled for the app, and the default.

Takes no parameters.

The app language pack. Returns an `ETag`; send `If-None-Match` and get **304** when unchanged. Editing a string in the panel changes the stamp immediately — no app release needed to fix wording.

Published announcements.

Social media accounts. An account left empty or `#` in the panel is OMITTED from the response, so the app never draws a dead button.

Takes no parameters.

Published partners. No pagination by design: the list is entered by hand and is dozens of rows, not thousands. Rows with `is_active = 0` are never returned. Unlike blog, this endpoint DOES fall back to the default language — a partner name is a proper noun and hiding an untranslated row would drop the organisation from the list. `link_url` is raw; the client filters the scheme.

Frequently asked questions and their categories.

Legal documents; a single document when `slug` is given.

Protocol whitepaper, section by section.

Published blog posts. Pagination uses a TWO-PART cursor: `before_published_at` + `before_id`, ordered by `published_at DESC, id DESC` — an id-only cursor is not enough because publish dates can be scheduled. `featured` is NOT part of the ordering. No language fallback: a post without text in the requested language does not appear at all.

Full body of one post, addressed by SLUG (slug is per-language and is the post identity in that language). Unpublished posts also return `post_not_found` — saying "exists but draft" would leak draft titles. Body is `blocks` format: newline-separated lines in a markdown subset. The server emits no HTML; parsing is the client's job.