Developer Documentation

Introduction to Tick ID

Tick ID is the centralized identity provider for all applications within the Project Tick ecosystem. It allows users to securely authenticate with your external software using their primary Project Tick credentials.

The Identity Token

Each user is assigned a cryptographically signed Identity Token. Users can retrieve this token directly from their personal Dashboard. Your application acts as a client that consumes this token to verify the user's existence and authority.

Developer Note: Identity tokens are persistent but can be reset by the user for security. Your application must send this token in the Authorization: Bearer header for all API requests.

Verifying User Identity

To confirm that a token provided by a user is valid and to retrieve their profile data, you should use our verification endpoint.

GET /api/identity/me

Request Structure

This endpoint requires Bearer Token authentication.

curl -X GET "http://193.164.4.214/api/identity/me" \
     -H "Authorization: Bearer YOUR_USER_TOKEN"

Response Example

{
  "id": 142,
  "username": "grxtor",
  "email": "user@example.com",
  "roles": ["ROLE_USER"],
  "authenticated_via": "Tick ID"
}

In case of an invalid or expired token, the API will return a 401 Unauthorized response.

License Verification API

Verify Project Tick licenses directly within your delivery systems. Our API allows for instant, real-time validation of license keys and ownership.

POST /api/license/verify

Request Body (JSON)

{
  "license_key": "PT-XXXX-XXXX-XXXX-XXXX"
}

Response Structure

A successful verification returns the following metadata:

{
  "status": "valid",
  "product": "ProjT Launcher Pro",
  "expires_at": "2026-12-31T23:59:59Z",
  "owner": "user_id_12"
}

If the key is invalid, revoked, or expired, the status field will reflect the reason for the failure.

Security Standards

Project Tick utilizes industry-standard security protocols to ensure the integrity of the ecosystem.

Cryptographic Signing: All Identity Tokens are signed using the HS256 (HMAC with SHA-256) algorithm via our central authority.
Data Isolation: User passwords are never exposed via the API. Only non-sensitive identity and authorization claims are transmitted.
Rate Limiting: All API endpoints are protected against brute-force attacks with sophisticated request throttling.

We strongly recommend developers store user tokens in an encrypted format within their local databases.

Developer Portal