Tokens

A token is generated when a user authorizes your app. Use it to make API calls without re-authorizing.

GET /api/oauth/me — fetch user info

Request

fetch("https://omegacases.com/api/oauth/me?token=TOKEN_HERE")

Response

{
  "user_id":  "uuid-here",
  "username": "player1",
  "balance":  42.50
}

Only returns fields the token has scope for.

Token behaviour

PersistentTokens don't expire — they last until the user revokes them

ScopedEach token only grants the scopes the user approved

last_used_atUpdated automatically on every API call

RevocationUsers can revoke tokens from their account settings

Treat tokens like passwords. Never log them, expose them client-side, or commit them to source control.