Skip to content
HADİ Developers

First call in 5 minutes

  1. Developer account — an approved HADİ membership, identity verification, two-step verification and an account at least 30 days old. Create an app in the console; Tier 0 (sandbox) opens immediately.
  2. Keys — public clients (mobile, SPA) have no secret. Generate the DPoP key on the device (WebCrypto, extractable: false in browsers). Server clients use private_key_jwt; no client_secret in production.
  3. Authorize with PAR — post the parameters to POST /par, then redirect the user to https://auth.sandbox.hadisosyal.com/authorize?client_id=…&request_uri=….
  4. Code → tokens — POST /token with the PKCE code_verifier and a DPoP header. On use_dpop_nonce, retry with the returned DPoP-Nonce.
  5. First call — GET https://me.api.sandbox.hadisosyal.com/v1/me with Authorization: DPoP …, DPoP: …, HADI-Version: 2027-01-15.

The SDKs (TypeScript, Dart, Python) handle PKCE, DPoP, nonces and refresh rotation for you.