AfricaOne Developer API
Sandbox contract: public metadata, reviewed city discovery, OAuth 2.0 client credentials and authorization code with PKCE (user consent on africaone.io), refresh-token rotation, RFC 7009 revocation and the consented profile. Commerce, game sessions, webhooks management and production credentials are not in this contract and answer FEATURE_DISABLED. The platform is switched off in production unless DEVELOPER_PLATFORM_ENABLED is set.
Authentication
- HTTP: Bearer Auth
- HTTP: Basic Auth
A 300 s EdDSA access token from POST /oauth/token. Audience and environment must match the deployment; the app, developer, client secret and (for user tokens) the consent must all still be active, checked on every call. Scopes are checked per route (x-required-scopes).
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Bearer format: | at+jwt |
client_id and client_secret (RFC 6749 §2.3.1); or client_secret_post in the form body.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | basic |