API Access & Connected Apps

Let your own scripts, third-party apps and AI assistants work with your Grimoria data.

Personal API Keys

In Settings > API access, create a key with a name, the permissions it should have and an optional expiry. The key is shown once — copy it then. You can hold up to 10 active keys and revoke any of them at any time; each shows when it was last used.

Send it as Authorization: Bearer gma_… to https://grimoria.app/api/v1. Treat a key like a password.

Permissions

Keys and apps are scoped to what they may touch: read or write your collection, decks and wishlists, and read card data. A read-only key cannot change anything.

Connected Apps

Apps that use "Sign in with Grimoria" (OAuth 2.1 with PKCE) ask you on a consent page which permissions they want. Everything you have allowed is listed under Connected apps with the date, and one tap disconnects it.

For Developers

Base URL, OpenAPI spec, authentication flows, scopes, rate limits and error formats are documented on the developer page.