Signing a member in

Reading stories only takes your key. To act on a member's behalf (vote, comment, post a story, manage their favorites or profile), you need their token, obtained once with their login and password.

Is your app meant for members other than you? Use Sign in with FML instead: the member signs in on fmylife.com and your app never sees their password. Signing in with a password, as described here, is for your own tools.

Get the token

Send the login (username or email) and password to POST /user/authenticate, as a form:

curl -i "https://www.fmylife.com/api/v2/user/authenticate" \
  -H "X-VDM-Api-Key: $API_KEY" \
  --data-urlencode "[email protected]" \
  --data-urlencode "password=$PASSWORD"

The response has the member's profile in data, and their token in the X-VDM-Api-Token header:

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
X-VDM-Api-Key: …
X-VDM-Api-Token: 3f1c9b0e8d7a6f5e4d3c2b1a09f8e7d6

{"data":{"id":123456,"username":"Name",…},"meta":{}}

A wrong login or password returns a 401 with error 103, a banned account error 32 (see Errors).

Use the token

Add it in the X-VDM-Api-Token header of every request, along with your key. It only works with the key that obtained it.

curl -X PATCH "https://www.fmylife.com/api/v2/article/123456/bookmark" \
  -H "X-VDM-Api-Key: $API_KEY" \
  -H "X-VDM-Api-Token: $TOKEN"

In the reference, endpoints marked “Member token required” return a 401 without a valid token. The others accept a token too, and then take the member into account (their votes, favorites…).

Store and revoke the token

• Store the token (in the device's keychain for an app), never the password.
• The token stays valid until the member signs out. To sign them out, call GET /user/logout with their token: it gets deleted.
• An unknown token is ignored: the request goes through without a member, and an endpoint that requires a token returns a 401. Ask the member to sign in again.