Skip to content
On this site

Account API

Updated

The endpoints Wisply's Mac, iPhone and iPad apps use for sign-in, account deletion and subscription status. They aren't a public developer API: sign-in only accepts Apple and Google tokens issued to the Wisply app.

Want your recordings in other tools? On Mac, Wisply's local MCP server lets AI tools such as Claude Code, Cursor and Codex read your memos. See Integrations.

Sign-in and session
The app signs in with Apple or Google, then sends the returned access token as a Bearer token. Apple and Google tokens must be issued to the Wisply app.

POST /api/auth/apple

Sign in with an Apple identity token. Returns an access token, a refresh token and the user.

Body: { "identityToken", "user"? }

POST /api/auth/google

Sign in with a Google authorization code (PKCE). Returns an access token, a refresh token and the user.

Body: { "code", "codeVerifier", "redirectUri" }

POST /api/auth/refresh

Exchange a refresh token for a new access token and refresh token.

Body: { "refreshToken" }

GET /api/auth/verify

Check an access token and return the signed-in user with their subscription.

Header: Authorization: Bearer <accessToken>

GET /api/auth/account

Return the signed-in account, its sign-in providers and its subscription.

Header: Authorization: Bearer <accessToken>

DELETE /api/auth/account

Delete the signed-in account and its related records.

Header: Authorization: Bearer <accessToken>
Subscription
Purchases happen in the App Store. RevenueCat is the source of truth for whether a subscription is active.

GET /api/subscription/status

Return the signed-in user’s stored subscription, or the free tier when there is none.

Header: Authorization: Bearer <accessToken>

POST /api/subscriptions/verify

Re-check the signed-in user’s subscription with RevenueCat and store the result. The body is required, but RevenueCat’s record decides the outcome.

Header: Authorization: Bearer <accessToken>
Body: { "transactionId", "productId", "originalTransactionId"?, "environment"? }
Profile
The signed-in user’s name and email.

GET /api/user/profile

Return the signed-in user’s profile.

Header: Authorization: Bearer <accessToken>

PATCH /api/user/profile

Update the signed-in user’s display name.

Header: Authorization: Bearer <accessToken>
Body: { "name" }
Store notifications
Server-to-server endpoints for subscription events. Apps don’t call these.

POST /api/subscription/webhook

Receive RevenueCat webhook events.

Requires the configured RevenueCat Authorization header

POST /api/webhooks/appstore

Receive App Store Server Notifications (version 2).

Requires a payload signed by Apple