Chizmis Authentication

BASE API : https://api.chizmis.com

Chizmis is the identity source for ChizVerse integrations. The callback token authenticates Chizmis and ChizPay requests. Exchange that token through ChizVerse Core Auth to obtain the separate ChizVerse bearer required to create Game Manager launches.

Authentication Flow

Validate the registered clientId and redirectUri.

Redirect the player to hosted sign-in or sign-up.

Receive the callback token at redirectUri?t=<token>.

Persist the access token and sessionKey.

Use authorization: Bearer <token> for protected API calls.

Use saved account/session endpoints for account switching.

Call logout when the player signs out.

Exchange for a ChizVerse Bearer

After receiving t from the Chizmis callback, exchange it for the ChizVerse bearer used by protected ChizVerse endpoints.

Method & URL

POST https://api-chizverse.beespokedev.com/core/public/auth/chizmis

Headers

Name	Type	Required	Description
`Content-Type`	string	Yes	`application/json`

Request Body

{
  "token": "<chizmis-callback-token>"
}

Response Example

{
  "success": true,
  "response": {
    "token": "<chizverse-access-token>",
    "refreshToken": "<chizverse-refresh-token>",
    "user": {
      "id": 1024,
      "email": "juan@example.com"
    }
  }
}

Use response.token as authorization: Bearer <token> for Create Launch. Continue using the original Chizmis token for Chizmis and ChizPay endpoints.

Getting `clientId` and `redirectUri`

Use the ChizVerse Developer Console to create or configure the game application that will use Chizmis sign-in.

Open the profile menu and select Developer Console.

$Open the Developer Console from the profile menu$

Create a game, or open an existing game from the Developer Console. When creating a game, enter the required title and description, then select Create Game.

Open the game's Config page and set Callback URL to the exact URL that should receive the auth callback, then use that same value as redirectUri.

Use the registered Chizmis application client ID assigned to the game as clientId.

Select Save after changing the Callback URL.

[!IMPORTANT]
redirectUri must match the saved Callback URL exactly, including scheme, domain, port, and path. For local testing, a value like http://localhost:8080/callback is valid only when the same value is saved in the console.

Starts the Chizmis hosted sign-in flow. This is a browser navigation URL, not a JSON API call. The SDK builds this URL through auth.signIn().

Method & URL

GET https://access.chizmis.com/auth/login

For sign-up mode:

GET https://access.chizmis.com/register

Headers

No custom headers required.

Query Parameters

Name	Type	Required	Description
`clientId`	string	Yes	Registered client application ID.
`redirectUri`	string	Yes	Allowed redirect URI for auth flow. Must match the client application's saved Callback URL.

Request Body

No request body.

Behavior

Opens the Chizmis hosted login or registration page.

After successful login, redirects back to redirectUri with callback token query parameter: ?t=<token>.

Success Response

This endpoint is redirect-based and typically returns:

302 Found with a Location header to the hosted login URL.

Callback Example

https://your-app.com/login?t=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Getting `sessionKey` and `uid`

The callback token (t) contains the values needed by session-based endpoints.

Parse/decode the token payload.

Read:

sessionKey from sessionKey

uid from uid

Example payload shape:

{
  "uid": 1024,
  "sessionKey": "session-abc123",
  "exp": 1790000000
}

Error Responses

Status	Meaning	Example Message
`400`	Invalid query values	`redirectUri is required`
`401`	Unauthorized client	`Unauthorized client`
`404`	Client app not found	`Client not found`
`500`	Internal server error	`Internal server error`

Logout

Terminates an active session using sessionKey and uid.

[!TIP]
You can extract both values by parsing the callback/access token (t): use payload.sessionKey and payload.uid.

Method & URL

POST /public/auth/logout

Headers

Name	Type	Required	Description
`Content-Type`	string	Yes	Use `application/json`.

Request Body

Name	Type	Required	Description
`sessionKey`	string	Yes	Session key to terminate.
`uid`	number	Yes	User ID associated with the session.

{
  "sessionKey": "sess_abc123",
  "uid": 1024
}

Response Example

{
  "success": true,
  "response": {}
}

Error Responses

Status	Meaning	Example Message
`400`	Invalid payload	`sessionKey is required`
`401`	Unauthorized session	`Unauthorized`
`500`	Internal server error	`Internal server error`

Get Current Account

Retrieves the authenticated user profile from the access token.

Method & URL

GET /access/v1.0/accounts/me

Headers

Name	Type	Required	Description
`authorization`	string	Yes	Bearer access token. Example: `Bearer <token>`.

Request Body

No request body.

Response Example

{
  "success": true,
  "response": {
    "id": 1024,
    "firstName": "Juan",
    "middleName": "S",
    "lastName": "Dela Cruz",
    "birthDate": "1998-01-01T00:00:00.000Z",
    "lastLogin": "2026-05-06T10:00:00.000Z",
    "avatar": "https://cdn.example.com/avatar.png",
    "email": "juan@example.com",
    "isActive": true,
    "signUpWith": "LOCAL"
  }
}

Error Responses

Status	Meaning	Example Message
`401`	Missing/invalid token	`Unauthorized`
`404`	Account not found	`Account not found`
`500`	Internal server error	`Internal server error`

Validate Client Application

Validates whether clientId and redirectUri are allowed.

Method & URL

GET /access/public/auth/validate

Headers

No custom headers required.

Query Parameters

Name	Type	Required	Description
`clientId`	string	Yes	Registered client application ID.
`redirectUri`	string	Yes	Allowed redirect URI for auth flow. Must match the client application's saved Callback URL.

Request Body

No request body.

Response Example

{
  "success": true,
  "response": {
    "valid": true
  }
}

Error Responses

Status	Meaning	Example Message
`400`	Invalid query values	`redirectUri is required`
`404`	Client app not found	`Client not found`
`500`	Internal server error	`Internal server error`

Authenticates a user using a previously issued sessionKey and uid.

[!TIP]
sessionKey and uid can be obtained by parsing the callback/access token (t) and reading payload.sessionKey and payload.uid.

Method & URL

POST /access/public/auth/session

Query Parameters

Name	Type	Required	Description
`clientId`	string	Yes	Registered client application ID.
`redirectUri`	string	Yes	Registered redirect URI for the client app. Must match the saved Callback URL.

Request Body

Name	Type	Required	Description
`sessionKey`	string	Yes	Existing session key.
`uid`	number	Yes	Account ID in that session.

{
  "sessionKey": "session-abc123",
  "uid": 1024
}

Response Example

{
  "success": true,
  "response": {
    "token": "<access-token>",
    "data": {
      "email": "juan@example.com",
      "firstName": "Juan",
      "lastName": "Dela Cruz",
      "middleName": "S",
      "avatar": "https://cdn.example.com/avatar.png",
      "lastLogin": "2026-05-06T10:00:00.000Z"
    },
    "sessionKey": "session-abc123"
  }
}

Error Responses

Status	Meaning	Example Message
`400`	Invalid payload	`uid is required`
`401`	Session authentication failed	`Invalid session`
`404`	Session/user not found	`No session`
`500`	Internal server error	`Internal server error`

Verify Session Key

Returns accounts linked to a given session key.

Method & URL

GET /access/public/sessions/verify

Headers

No custom headers required.

Query Parameters

Name	Type	Required	Description
`sessionKey`	string	Yes	Session key to validate.

Request Body

No request body.

Response Example

{
  "success": true,
  "response": {
    "accounts": [
      {
        "id": 1024,
        "firstName": "Juan",
        "lastName": "Dela Cruz",
        "middleName": "S",
        "birthDate": "1998-01-01T00:00:00.000Z",
        "lastLogin": "2026-05-06T10:00:00.000Z",
        "avatar": "https://cdn.example.com/avatar.png",
        "email": "juan@example.com"
      }
    ]
  }
}

Error Responses

Status	Meaning	Example Message
`400`	Invalid query values	`sessionKey is required`
`500`	Internal server error	`Internal server error`

[!NOTE]
This endpoint can return HTTP 200 with accounts: [] and "message": "No session.".

Chizmis Authentication API

Authentication Flow#

Exchange for a ChizVerse Bearer#

Method & URL#

Headers#

Request Body#

Response Example#

Getting clientId and redirectUri#

Hosted Client Login#

Method & URL#

Headers#

Query Parameters#

Request Body#

Behavior#

Success Response#

Callback Example#

Getting sessionKey and uid#

Error Responses#

Logout#

Method & URL#

Headers#

Request Body#

Response Example#

Error Responses#

Get Current Account#

Method & URL#

Headers#

Request Body#

Response Example#

Error Responses#

Validate Client Application#

Method & URL#

Headers#

Query Parameters#

Request Body#

Response Example#

Error Responses#

Login with Existing Session#

Method & URL#

Query Parameters#

Request Body#

Response Example#

Error Responses#

Verify Session Key#

Method & URL#

Headers#

Query Parameters#

Request Body#

Response Example#

Error Responses#

Authentication Flow

Exchange for a ChizVerse Bearer

Method & URL

Headers

Request Body

Response Example

Getting `clientId` and `redirectUri`

Hosted Client Login

Method & URL

Headers

Query Parameters

Request Body

Behavior

Success Response

Callback Example

Getting `sessionKey` and `uid`

Error Responses

Logout

Method & URL

Headers

Request Body

Response Example

Error Responses

Get Current Account

Method & URL

Headers

Request Body

Response Example

Error Responses

Validate Client Application

Method & URL

Headers

Query Parameters

Request Body

Response Example

Error Responses

Login with Existing Session

Method & URL

Query Parameters

Request Body

Response Example

Error Responses

Verify Session Key

Method & URL

Headers

Query Parameters

Request Body

Response Example

Error Responses