API REFERENCE

Authentication

Every protected request must include an API key issued by an administrator. All keys start with riikyy_ and must be sent in the X-API-Key header (or Authorization: Bearer <key>).

GET /api/v1/profile

Example request:

curl https://riikyy.my.id/api/v1/profile \
  -H "X-API-Key: riikyy_..."

Response:

{
  "success": true,
  "message": "Authenticated API request.",
  "key": {
    "id": 42,
    "name": "Mobile App",
    "prefix": "riikyy_abcdef"
  },
  "serverTime": "2026-08-23T12:34:56.789Z"
}

GET /api/v1/status

Returns current key status, quota, and usage.

{
  "success": true,
  "service": "Nova API Gateway",
  "key": {
    "id": 42,
    "name": "Mobile App",
    "expiresAt": "2026-09-22T12:34:56.789Z",
    "quota": 1000,
    "used": 42
  },
  "serverTime": "2026-08-23T12:34:56.789Z"
}

ALIGHT MOTION PREMIUM

Activation API

Endpoints to send magic links, verify sign‑in, and apply premium subscription. All require a valid API key.

POST /api/v1/alight/send-link

Send a sign‑in magic link to the user's email address.

Request body:

{
  "email": "user@example.com"
}

Response (success):

{
  "success": true,
  "message": "Link berhasil dikirim."
}

Response (error):

{
  "success": false,
  "error": "…"
}

POST /api/v1/alight/verify

Verify the magic link (or oobCode) and obtain an idToken for the user.

Request body (with full link):

{
  "email": "user@example.com",
  "link": "https://alightcreative.com?oobCode=abc123..."
}

Request body (with oobCode only):

{
  "email": "user@example.com",
  "oobCode": "abc123..."
}

Response (success):

{
  "success": true,
  "idToken": "eyJhbGciOiJSUzI1NiIsImtpZCI6...",
  "user": {
    "localId": "...",
    "email": "user@example.com",
    "displayName": "",
    "photoUrl": "",
    "emailVerified": false,
    "providerUserInfo": [...]
  }
}

Response (error):

{
  "success": false,
  "error": "Gagal mengekstrak oobCode."
}

POST /api/v1/alight/apply

Apply premium subscription using the idToken obtained from verification.

Request body:

{
  "idToken": "eyJhbGciOiJSUzI1NiIsImtpZCI6..."
}

Response (success):

{
  "success": true,
  "data": {
    // response from Alight's cloud function
  },
  "orderId": "tskiofc-12345"
}

Response (error):

{
  "success": false,
  "error": "…"
}

Key lifecycle

API keys are generated server‑side, stored as SHA‑256 hashes, shown in full only once, and can be revoked by an administrator. Keys have a configurable expiration (1–365 days) and optional request quota.