Dev To Authentication

generated: '2026-09-17'
method: searched
source: https://dev.to/openapi.json (components.securitySchemes) + https://developers.forem.com/api
docs: https://developers.forem.com/api
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - header
  notes: >-
    Forem API V1 accepts two credentials. The universal one is the per-user `api-key` header,
    generated by the account holder at https://dev.to/settings/extensions. Instances that enable
    delegated access additionally accept an RFC 9068 `Authorization: Bearer` JWT minted by the
    instance's configured delegation service and verified against its JWKS. Every V1 request must
    also carry `Accept: application/vnd.forem.api-v1+json` — the Accept header is the version
    selector, not a path segment, and omitting it silently routes the call to the deprecated V0 API.
schemes:
- name: api-key
  type: apiKey
  in: header
  parameter: api-key
  description: >-
    Per-user API key. Authentication for write operations (Articles, Reactions, Follows, Webhooks)
    requires a DEV API key; many read endpoints are accessible publicly without one. All
    authenticated endpoints are CORS-disabled — the key is intended for non-browser scripts.
  obtain: https://dev.to/settings/extensions
  sources:
  - https://dev.to/openapi.json
- name: bearer_auth
  type: http
  scheme: bearer
  bearer_format: JWT
  description: >-
    Short-lived RS256 RFC 9068 access token issued by the configured delegation service and verified
    against its configured JWKS. The issuer authorizes the client and requested operation before
    minting the token; Forem validates it and resolves its subject and owner to a local user. An
    invalid token returns 401; an unavailable trust dependency with no usable cached key returns 503.
    Available only on instances that enable delegated access.
  sources:
  - https://dev.to/openapi.json
required_headers:
- name: Accept
  value: application/vnd.forem.api-v1+json
  reason: >-
    Selects API version 1. Omitting it routes to the deprecated V0 API (the server replies with a
    299 Warning header pointing at the V1 Accept header).
oauth2: false
scopes_published: false
notes: >-
  No OAuth 2.0 authorization-code flow is published for the API surface, so no scopes/ artifact is
  emitted. Social sign-in (GitHub, Twitter) exists for the web application only, not for API clients.