---
title: Authentication on the What I Wish public API
description: The public API needs no credentials. What the one declared security scheme is for, and what you cannot do with a token.
canonical: https://whatiwish.app/auth.md
---

# Authentication on the What I Wish public API

Canonical docs: https://whatiwish.app/docs#permissions

## Public operations: no credentials

Every operation in the [OpenAPI document](https://whatiwish.app/openapi.json) answers without an account, an API key or a token:

- `GET /api/v1/public-wishlist/{slug}` reads a published gift list.
- `POST /api/v1/reserve` reserves an item as a guest (it needs the Cloudflare Turnstile token that the public list page issues, which is an anti-abuse check, not authentication).
- `POST /api/v1/unfurl` and `POST /api/v1/scrape-product` turn a product URL into title, image and price.

There is one permission level and it is anonymous. There are no scopes to request, no key to generate, nothing to sign up for. Quotas are per client IP and reported in the `RateLimit`, `RateLimit-Policy` and `X-RateLimit-*` response headers; a 429 adds `Retry-After`.

## The declared security scheme

`components.securitySchemes.firebaseSession` in the spec is a bearer JWT: the Firebase ID token of a signed-in list owner. No public operation uses it. It is declared only to name the credential the app itself sends to owner-only endpoints (creating and editing lists, checking slug availability), which are deliberately outside the public API. The API offers no way to obtain that token, and a token obtained from the app cannot be used to read other people's private lists.

## What does not exist

- No OAuth 2.0 or OpenID Connect server, so no `/.well-known/oauth-authorization-server` and no `/.well-known/oauth-protected-resource`.
- No API keys and no paid tier.
- No webhooks or event subscriptions.

If any of that ships, it will be announced at https://whatiwish.app/docs first.