Authentication

The Ummat API supports two authentication methods: API keys for server-to-server requests and OAuth 2.0 bearer tokens for user-delegated access.

API key authentication

Obtain an API key from the Developer panel. Keys are prefixed with umk_live_ (production) or umk_sandbox_ (sandbox).

Pass your key in the Authorization header on every request:

POST https://api.ummat.dev/v1/graphql
Authorization: Bearer umk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/json

{ "query": "{ up_masjids(limit: 10) { id name } }" }

Key scopes

Keys are created with one or more scopes. A request that reads data your key has no scope for returns HTTP 403. Available scopes:

OAuth 2.0 bearer tokens

Use OAuth when your app acts on behalf of a logged-in Ummat user. The API supports Authorization Code + PKCE and Client Credentials flows. See OAuth 2.0 for the full flow.

Pass the access token as a bearer token:

Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...

Security notes

• Never expose API keys in client-side code or public repositories.
• Rotate keys immediately if they are compromised — revoke from the developer panel.
• Each key can be scoped to specific IP ranges (coming soon).
• Sandbox keys (umk_sandbox_) only work against the sandbox endpoint.

Errors