Quick Start

Two endpoints. Send a code, verify a code. That's the whole integration.

1.Get your API key

Keep it secret. Every request must include it in the Authorization header.

2.Request a verification code

Call this when a user wants to verify (login, reset, sensitive action). Omega emails them a single-use code.

POST https://omega1.jsl-ian.com/reset/request
Authorization: Bearer omega_sk_YOUR_KEY
Content-Type: application/json

{
  "userId": "your-user-id",
  "email": "user@example.com",
  "chainToken": "..."   // optional — see step 4
}

Response:

{
  "requestId": "6b0b8465-...",
  "chainStatus": "first"  // or "ok" / "broken"
}

Save the requestId — you'll need it for verification. The code expires in 10 minutes.

3.Verify the code

The user enters the code they received. Send it back with the requestId:

POST https://omega1.jsl-ian.com/reset/verify
Authorization: Bearer omega_sk_YOUR_KEY
Content-Type: application/json

{
  "requestId": "6b0b8465-...",
  "code": "the-code-from-the-email"
}

Response on success:

{
  "success": true,
  "userId": "your-user-id",
  "nextChainToken": "36ac445d..."
}

Codes are single-use. A second attempt with the same code returns 410.

4.Store the chain token (recommended)

Each successful verification returns a nextChainToken. Store it on the client, and include it as chainToken the next time that user verifies.

The chainStatus field in the response then tells you:

Value	Meaning
first	User's first verification — no history yet.
ok	This verification is a confirmed continuation of the last one.
broken	Continuity could not be confirmed. The user can still verify normally; treat this as a risk signal (e.g., new device, cleared storage, or something suspicious).

The chain token is optional. Skipping it never blocks your users — it just means you don't receive the continuity signal.

Error responses

Status	Meaning
401 Unauthorized	Missing or invalid API key, or the code didn't match.
404	Unknown requestId.
410	Code already used, or expired (10-minute window).
400	Missing required fields.

That's it

Two calls, one optional token. Questions or key requests: contact JSL-ian Technologies.