DevConsole integration documentation

01 — Create your project

Choose monthly or yearly access, complete payment, then create a project using your paid plan. Each project gets a unique API URL. Generate one active API key per service from its detail page; revoke it before creating a replacement. New accounts require a paid plan before project access is unlocked.

02 — Read project metadata

GET /api/v1/projects/:id returns id, name, description and created. This endpoint reads project metadata; it does not publish an OTA bundle or build an App Clip. Use the matching service key from your backend. Invalid keys return 401 and inactive service access returns 403.

curl "https://devconsole.top/api/v1/projects/PROJECT_ID" \
  -H "Authorization: Bearer YOUR_API_KEY"

03 — Send a webhook event

Create an incoming endpoint in your authenticated project workspace. POST JSON to /api/hooks/HOOK_ID with X-Webhook-Secret. The endpoint stores an event type (up to 100 characters) in the activity log and returns HTTP 202 with received and id. It does not forward the event to an external destination. Invalid secrets return 401; inactive access returns 403.

curl -X POST "YOUR_WEBHOOK_URL" \
  -H "Content-Type: application/json" \
  -H "X-Webhook-Secret: YOUR_WEBHOOK_SECRET" \
  -d '{"type":"release.published"}'

04 — WhatsApp OTP add-on

Add WhatsApp OTP to a paid project plan. Your server sends and verifies codes using the WhatsApp service key for this project. After a confirmed WhatsApp OTP purchase, enter your setup mobile number (+965 is prefilled); it is saved for configuration. Meta credentials and an approved copy-code authentication template must be configured by the admin. Provider settings are shared per environment; separate per-customer Meta accounts are not implemented. Test recipients must be allowlisted.

POST YOUR_PROJECT_API_URL/otp/send
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{"phone":"+965XXXXXXXX","purpose":"login"}

Use the returned challengeId with the six-digit code entered by your user:

POST YOUR_PROJECT_API_URL/otp/verify
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{"challengeId":"otp_…","phone":"+965XXXXXXXX",
 "purpose":"login","code":"123456"}

Send returns HTTP 202 with challengeId, expiresIn (300) and status (accepted). Verify returns verified (true) and purpose. An invalid service key returns 401; a non-WhatsApp key returns 403; missing paid project/WhatsApp access returns 402; disabled Meta setup returns 503. Phone numbers must use international + format; purpose uses 1–60 letters, digits, underscore, dot or hyphen. Sending allows one request per recipient per account per 60 seconds, at most 10 requests per minute and 100 per day across the account in the active environment (429 on limit). Codes expire after five minutes and can be used only once, with five attempts maximum. A send response of accepted means Meta accepted the request, not that the message was delivered. Keep API keys on your server and verify the phone and purpose match your own pending login before creating an app session. This does not change DevConsole’s account login.

App integration

Project credentials connect to this workspace API. They do not automatically install an update engine or create an Apple App Clip.

OTA App Updates

Deliver eligible JavaScript fixes, interface changes and assets through a compatible update SDK already included in your app. Supported updates may avoid a new store submission, but must remain within Apple and Google policies and your installed runtime’s capabilities.

• Fix supported JavaScript bugs and adjust existing screens or assets.
• Users receive updates when the app checks for them; application may happen on a later launch, depending on the integration and connectivity.
• Native modules, permissions, SDK changes and other changes requiring store review need a new signed build and store release.

DevConsole project credentials do not themselves install or configure an update engine. Connect your app’s update platform before publishing. OTA updates cannot bypass Apple or Google review rules.

Fast App Clip

An App Clip is a focused iOS experience that opens before the full app is installed. Your developer must build an App Clip target, create a signed build, configure invocation links or App Clip codes and set up the experience in App Store Connect. Apple review and platform eligibility apply. DevConsole provides project credentials and connection details; it does not automatically build or publish your App Clip.