Noas | Docs

POST /api/v1/auth/register

Create account and send verification email.

GET /api/v1/auth/verify?token=...

Preview verification token state.

POST /api/v1/auth/verify

Verify token + password hash and activate account.

Request body

{
  "token": "verification_token",
  "password_hash": "sha256_hex"
}

POST /api/v1/auth/resend

Resend verification email for a pending account.

Request body

{
  "username": "alice"
}

POST /api/v1/auth/signin

Sign in and fetch encrypted key, pubkey, relays, and role.

Request body

{
  "username": "alice",
  "password_hash": "sha256_hex"
}

POST /api/v1/auth/update

Update password/key bundle, relays, and profile picture. Auth accepts `password` or `password_hash`.

Request body

{
  "username": "alice",
  "password": "current_password",
  "updates": {
    "new_password": "new_password",
    "public_key": "64_char_hex",
    "private_key_encrypted": "ncryptsec1...",
    "relays": ["wss://relay.example.com"],
    "profile_picture_data": "base64",
    "profile_picture_content_type": "image/png"
  }
}

Credential rotation requires `new_password` or `new_password_hash` together with `public_key` and `private_key_encrypted`.

POST /api/v1/auth/delete

Delete authenticated account permanently.

POST /api/v1/admin/users/list

Admin/moderator user listing.

POST /api/v1/admin/users/verify

Admin/moderator verification of pending accounts.

POST /api/v1/admin/users/role

Admin-only role assignment (`user`, `moderator`, `admin`), including self-downgrade with immediate permission changes.

POST /api/v1/admin/users/delete

Admin/moderator user deletion (requires confirm_username matching target_username).

GET /api/v1/picture/:identifier

Fetch profile picture by pubkey (`hex`/`npub`) or username.

GET /.well-known/nostr.json

NIP-05 verification + Noas metadata (without `name`).

GET /api/v1/health

Health status endpoint.

GET /api/v1/nip46/info

NIP-46 signer metadata and supported methods.

GET /api/v1/nip46/connect/:username

Generate bunker connection URL for active account.

POST /api/v1/nip46/nostrconnect

Process `nostrconnect://` client handshake.

POST /api/v1/nip46/request

Handle encrypted NIP-46 request events.

POST Legacy aliases and removed routes

Supported aliases: `/signin`, `/update`, `/delete`, `/picture/:identifier`, `/health`, `/nip46/*`. Removed with `410`: `/register`, `/onboarding/start`, `/onboarding/complete`, `/verify-email` (POST). `/verify-email` (GET) redirects to `/verify`.

API Reference