API Reference

Full endpoint catalog.

Base URLs

Service	URL
CP-Auth	`https://auth.cp-platform.com`
CP-Pay	`https://pay.cp-platform.com`
CP-Notify	`https://notify.cp-platform.com`
CP-Tools	`https://tools.cp-platform.com`
CP-API (external public)	`https://api.cp-platform.com`

Authentication headers

Header	Used by
`Authorization: Bearer <access_token>`	User token (or the HttpOnly `access_token` cookie)
`X-API-Key: <api_key>`	Service-to-service calls, external developers
`X-API-Key: <admin_key>`	Admin API

CP-Auth

OAuth

GET/oauth/login

Authentication: No authentication required

POST/oauth/authorize

Authentication: No authentication required
Rate Limit: 150/min

POST/oauth/token

Authentication: No authentication required
Rate Limit: 300/min

GET/oauth/userinfo

Authentication: User token

GET/oauth/callback

Authentication: No authentication required

User auth & profile

POST/auth/login

Authentication: No authentication required
Rate Limit: 600/min

POST/auth/signup

Authentication: No authentication required
Rate Limit: 300/min

POST/auth/refresh

Authentication: No authentication required
Rate Limit: 300/min

POST/auth/logout

Authentication: User token

POST/auth/verify

Authentication: No authentication required
Rate Limit: 600/min

GET/auth/me

Authentication: User token
Rate Limit: 3000/min

POST/auth/oauth/exchange

Authentication: No authentication required
Rate Limit: 300/min

CP-Pay

One-off payments

POST/payments/direct/checkout

Authentication: API Key
Permission: pay.payments.direct
Rate Limit: 600/min

POST/payments/direct/confirm

Authentication: API Key
Permission: pay.payments.direct
Rate Limit: 600/min

Subscriptions (external services — api-key)

POST/subscriptions/checkout/external

Authentication: API Key
Permission: pay.subscriptions.checkout
Rate Limit: 1800/min

POST/subscriptions/confirm/external

Authentication: API Key
Permission: pay.subscriptions.checkout
Rate Limit: 900/min

GET/subscriptions/status/external?user_id={uuid}

Authentication: API Key
Permission: pay.subscriptions.checkout

Subscriptions (CP user-authenticated)

GET/subscriptions/plans

Authentication: No authentication required

POST/subscriptions/checkout/toss

Authentication: User token
Rate Limit: 900/min

POST/subscriptions/confirm/toss

Authentication: User token
Rate Limit: 900/min

GET/subscriptions/current

Authentication: User token

POST/subscriptions/cancel

Authentication: User token

POST/subscriptions/resume

Authentication: User token

Webhook management

PUT/developers/apps/{app_id}/webhook

Authentication: User token

POST/developers/apps/{app_id}/webhook/regenerate-secret

Authentication: User token

GET/developers/apps/{app_id}/webhook/deliveries

Authentication: User token

CP-Notify

POST/notifications/email

Authentication: API Key
Permission: notify.email.send
Rate Limit: 200/min

POST/notifications/sms

Authentication: API Key
Permission: notify.sms.send
Rate Limit: 3000/min

POST/notifications/kakao

Authentication: API Key
Permission: notify.kakao.send
Rate Limit: 3000/min

POST/notifications/push

Authentication: API Key
Permission: notify.push.send
Rate Limit: 3000/min

GET/notifications/quotas

Authentication: API Key

GET/notifications/usage

Authentication: API Key

SDK — `@cp-platform/auth-sdk` v0.5.2

npm i git+https://github.com/Copark-Dev/cp-auth-sdk.git#v0.5.2

Types ship with the SDK — no separate .d.ts download.

Frontend — `CpAuthClient`

import { CpAuthClient } from "@cp-platform/auth-sdk";
 
const auth = new CpAuthClient({
  authUrl: "https://auth.cp-platform.com",
  productOrigin: "https://your-app.com",
  // storage: "localStorage" | "memory" | TokenStorage
});
 
const oauth = await auth.startOAuth("google");
if (!oauth.blocked && "url" in oauth) window.location.assign(oauth.url);
 
const signup = await auth.signup({ email, password, phone, phone_consent: true });
// signup.status: "authenticated" | "verification_required"
await auth.login(email, password);
await auth.requestPasswordReset(email);
await auth.confirmPasswordReset(token, newPassword);
await auth.verifyEmail(token);
 
const user = await auth.getMe();
const accessToken = await auth.ensureAccessToken();
auth.isLoggedIn();
await auth.logout();

React — `CpAuthProvider` / `useCpAuth`

<CpAuthProvider strict>...</CpAuthProvider>
 
const { guardOAuth } = useCpAuth();
guardOAuth(provider): "proceed" | "redirected" | "blocked";

With strict on, mobile UAs outside the Safari/Chrome/Samsung/Firefox/Edge/Opera/Brave/DuckDuckGo whitelist are treated as in-app.

Backend — `verifyCpJwt` / `CpServerClient`

import { verifyCpJwt } from "@cp-platform/auth-sdk/jwt";
import { CpServerClient } from "@cp-platform/auth-sdk/server";
 
const { cpUserId, email } = await verifyCpJwt(bearerToken);
// Auto Supabase JWKS cache (ES256)
 
const cp = new CpServerClient(); // authUrl defaults to https://auth.cp-platform.com
const tokens = await cp.exchangeOAuthCode(code, codeVerifier);
const user = await cp.getUserInfo(tokens.access_token);

In-app browser helpers

import { detectInAppBrowser, buildChromeIntentUrl } from "@cp-platform/auth-sdk";
 
const info = detectInAppBrowser(navigator.userAgent, { strict: true });
// { isInApp, appName, isAndroid, isIOS, unknownInApp }
 
const intent = buildChromeIntentUrl("https://your-app.com/login");
// intent://... — Android Chrome escape

Patterns covered (30+ named apps + WebView fallback): Meta · WeChat · X · TikTok · Snapchat · Pinterest · Reddit · Discord · Telegram · Slack / KakaoTalk · KakaoStory · Naver · Daum · LINE · BAND · EveryTime · Blind / KakaoBank · KakaoPay · Toss · KB · Woori · Shinhan · Hana · NH · IBK / Coupang · Baemin · Karrot · 11st · SSG · Emart · Lotte · Gmarket.