> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thefaithapp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Sign in a member and make your first authenticated TheFaithApp API request.

# Make your first request

This quickstart uses hosted auth to obtain a member token, then calls `GET /v1/user` with both required credentials.

## Before you begin

In `Settings > Developer Access` in the TheFaithApp dashboard:

1. Copy your client API key.
2. Add the exact callback URL that will receive the member after sign-in.

For local development, save a dedicated callback such as `http://localhost:3000/auth/callback`. Production and local callback URLs must each be added explicitly.

<Steps>
  <Step title="Create a hosted sign-in URL">
    Generate a cryptographically random `state` value and send it with your callback URL.

    ```bash theme={null}
    curl -X POST https://api.thefaithapp.com/v1/auth/start \
      -H "Content-Type: application/json" \
      -d '{
        "client_key": "your-client-api-key",
        "redirect_uri": "https://example.com/auth/callback",
        "state": "replace-with-a-random-value"
      }'
    ```

    The response includes `auth_url`. Open it in the system browser or a browser-based mobile auth session.
  </Step>

  <Step title="Validate the callback">
    After sign-in, the member returns to your callback URL:

    ```text theme={null}
    https://example.com/auth/callback?code=one-time-code&state=replace-with-a-random-value
    ```

    Reject the callback if `state` does not exactly match the value stored when sign-in began. Exchange `code` immediately; it is short-lived and single-use.
  </Step>

  <Step title="Exchange the code">
    ```bash theme={null}
    curl -X POST https://api.thefaithapp.com/v1/auth/token \
      -H "Content-Type: application/json" \
      -d '{
        "client_key": "your-client-api-key",
        "code": "one-time-code",
        "redirect_uri": "https://example.com/auth/callback"
      }'
    ```

    Store the returned `access_token` in secure server-side storage, an HTTP-only secure session cookie, Keychain, or Keystore.
  </Step>

  <Step title="Load the member">
    ```bash theme={null}
    curl https://api.thefaithapp.com/v1/user \
      -H "X-API-Key: your-client-api-key" \
      -H "Authorization: Bearer your-member-access-token" \
      -H "Accept: application/json"
    ```

    A successful response contains `status: "Success"` and the member record in `data`.
  </Step>
</Steps>

## JavaScript example

```javascript theme={null}
const response = await fetch('https://api.thefaithapp.com/v1/user', {
  headers: {
    Accept: 'application/json',
    'X-API-Key': process.env.THEFAITHAPP_CLIENT_KEY,
    Authorization: `Bearer ${memberAccessToken}`,
  },
});

if (!response.ok) {
  const error = await response.json();
  throw new Error(error.message ?? error.error_message ?? 'TheFaithApp request failed');
}

const { data: member } = await response.json();
```

<Warning>
  Do not put a production client API key or member access token in frontend source code. Proxy sensitive calls through your backend when your runtime cannot protect credentials.
</Warning>

## Next steps

* Building with Flutter? Follow the [Flutter SDK Quickstart](/api-reference/flutter-sdk).
* Building with React Native or Expo? Follow the [React Native SDK Quickstart](/api-reference/react-native-sdk).
* Read the [Hosted Auth Guide](/api-reference/hosted-auth) before implementing production sign-in.
* Review [Pagination and Errors](/api-reference/pagination-and-errors) for resilient response handling.
* Open an endpoint in the reference to see generated cURL, JavaScript, and Python examples.