> For the complete documentation index, see [llms.txt](https://docs.connect.inloop.to/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.connect.inloop.to/quick-start.md).

# Quick Start

First, Create an API Secret Key on the [InLoop Connect Dashboard](https://connect.inloop.to/dashboard) and specify the ERC-20 tokens and/or NFTs that you would like to check for. This API key will identify your application when making API requests.

You may revoke an API key at any time.

## Flow overview

#### How your users verify their NFT ownership

1. Your user clicks a *Verify with token* button on your website.
2. They are directed to InLoop Connect and are prompted to connect their wallet.
3. Once they connect their wallet, they will be redirected back to your page with a `code` appended to the query parameters. You can use this code to exchange for a user token and query for the user's ownership of which ERC-20 tokens and/or NFTs you specified in the dashboard.

**See the** [**Examples**](/examples.md) **page for code samples, or check out the API details below.**

## API

## Load an unbranded page for the user to connect their wallet

<mark style="color:blue;">`GET`</mark> `https://connect.inloop.to/oauth/authorize`

Once the user connects their wallet, they will automatically be navigated to the provided URL with the encrypted code in a query parameter: `https://<redirect_uri>?code=<code>`.\
\
The generated authorization code expires 10 minutes after issuance. The purpose of this code is to be immediately exchanged for a permanent user token by calling the `/api/v1/oauth/token` endpoint below. \
\
Try it out! Visit <https://connect.inloop.to/oauth/authorize?redirect_uri=https://google.com>

*Note: If the user clicks **Cancel** on the wallet connect flow, they will be navigated to `redirect_uri` without a `code` parameter. You might want to handle this case gracefully.*

#### Query Parameters

| Name                                            | Type   | Description                                                                                                                                                                                                                                                                                                                                                                                                                        |
| ----------------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| redirect\_uri<mark style="color:red;">\*</mark> | String | <p>The URL to redirect the user once they've connected their wallet. </p><p></p><p>We will append a query string to this URL (<code>?code=\<code></code> OR <code>\&code=\<code></code> if your URL already has query strings) that will contains a temporary authorization code that should subsequently be used to query <code><https://connect.inloop.to/api/v1/oauth/token></code> (below) to receive a user access token.</p> |

{% tabs %}
{% tab title="200: OK Success" %}

```javascript
{
    // Response
}
```

{% endtab %}
{% endtabs %}

## Exchange a code for a user token

<mark style="color:green;">`POST`</mark> `https://connect.inloop.to/api/v1/oauth/token`

Returns a long-lived user access token to uniquely identify the user that authorized. This token does not expire.

#### Headers

| Name                                            | Type   | Description                  |
| ----------------------------------------------- | ------ | ---------------------------- |
| Authorization<mark style="color:red;">\*</mark> | String | `Bearer YOUR_API_SECRET_KEY` |

#### Request Body

| Name                                   | Type   | Description                                                                                                                                                |
| -------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| code<mark style="color:red;">\*</mark> | string | The temporary authorization code received from the query string of the `redirect_uri` given to <https://connect.inloop.to/oauth/authorize> (above section) |

{% tabs %}
{% tab title="200: OK Success" %}

```javascript
{
    "user_token": "<user token>"
}
```

{% endtab %}

{% tab title="401: Unauthorized Permission denied" %}
Your API secret key is invalid.
{% endtab %}

{% tab title="400: Bad Request Authorization code error" %}

```javascript
{
    error: "Description of error"
}
```

Something is wrong with the authorization code passed in. It is likely that the code expired (there is a 10 minute expiry from when the code was issued).
{% endtab %}

{% tab title="429: Too Many Requests Exceeds rate limit" %}

```javascript
{
    // Response
}
```

{% endtab %}
{% endtabs %}

## List tokens (NFTs or ERC-20 tokens) from a user

<mark style="color:blue;">`GET`</mark> `https://connect.inloop.to/api/v1/users/:user_token/tokens`

Returns a list of NFTs from the collection addresses specified in your InLoop Connect dashboard. Please anticipate that this endpoint will take some time to run, especially if a long list of tokens is being checked.&#x20;

#### Path Parameters

| Name                                          | Type   | Description                                                                                                             |
| --------------------------------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------- |
| user\_token<mark style="color:red;">\*</mark> | String | The `user_token` of the user to verify. This token can be obtained from the `/oauth/authorize` and `/oauth/token` flow. |

#### Headers

| Name                                            | Type | Description                  |
| ----------------------------------------------- | ---- | ---------------------------- |
| Authorization<mark style="color:red;">\*</mark> |      | `Bearer YOUR_API_SECERT_KEY` |

{% tabs %}
{% tab title="200: OK Success" %}

```javascript
{
    user_token: "<user token>",
    wallet_address: "<user's connected wallet address>",
    tokens_owned: [
        {
            contract_name: "My NFT",        
            contract_address: "0x02c0f2ab1a5c2df8a895d12b34c885cfd6897b75",
            token_ids: [1, 5], // Returns an empty list if no token IDs found. Returns `null` if type is "erc20"
            quantity: 2,            
            network: "ethereum", // (or "polygon")            
            token_type: "erc721", // (or "erc20")
        },
        ...
    ]
}
```

{% endtab %}

{% tab title="401: Unauthorized Permission denied" %}

```javascript
{
    // Response
}
```

{% endtab %}

{% tab title="429: Too Many Requests Exceeds rate limit" %}

```javascript
{
    // Response
}
```

{% endtab %}
{% endtabs %}