App storage

App storage lets an application keep data for each member who signs in with AnythingAuth. Use it for game saves, progress, preferences, or any other JSON the app needs to remember between visits. A value can be an object, array, string, number, boolean, or null.

The application selects the storage scope when it is registered and requests it during authorization. Each key belongs to one application and one member, so another application cannot read or change it even when the same member uses both. The API never accepts an application or member ID in the request; the bearer token supplies both.

Endpoints

Send the member's access token as a bearer credential:

Request	Use
GET /oauth/storage	Lists keys with sizes and timestamps, plus current usage and limits.
GET /oauth/storage/saves/slot-1	Returns the stored JSON value.
PUT /oauth/storage/saves/slot-1	Creates the key, or replaces its value.
DELETE /oauth/storage/saves/slot-1	Removes the key.

Keys

Keys are 1 to 128 characters of letters, digits, dots, dashes, underscores and tildes, with single slashes allowed between segments. For example, saves/slot-1 is valid. A key must be unique inside one application and one member's storage.

Write or replace a value

Send a JSON body with Content-Type: application/json. Writing an existing key replaces its value and keeps its original creation time.

curl -X PUT "https://anything-advertising.com/oauth/storage/saves/slot-1" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary '{"level": 4, "score": 1200}'

A new key returns 201; replacing an existing key returns 200. Both return the entry's metadata:

{
  "entry": {
    "key": "saves/slot-1",
    "size": 30,
    "created_at": "2026-10-01T12:00:00Z",
    "updated_at": "2026-10-01T12:00:00Z"
  }
}

Read a value

The response body is the stored JSON document, not a wrapper:

curl "https://anything-advertising.com/oauth/storage/saves/slot-1" \
  -H "Authorization: Bearer ACCESS_TOKEN"

{
  "level": 4,
  "score": 1200
}

List keys and usage

List every key this application holds for the member. The response also reports the current entry count, byte total, and the active limits:

curl "https://anything-advertising.com/oauth/storage" \
  -H "Authorization: Bearer ACCESS_TOKEN"

{
  "entries": [
    {
      "key": "saves/slot-1",
      "size": 30,
      "created_at": "2026-10-01T12:00:00Z",
      "updated_at": "2026-10-01T12:00:00Z"
    }
  ],
  "usage": {
    "objects": 1,
    "bytes": 30,
    "max_object_bytes": 1048576,
    "max_bytes": 8388608,
    "max_objects": 100
  }
}

Delete a value

Delete a key when the data is no longer needed. A successful delete returns 204 with no body:

curl -X DELETE "https://anything-advertising.com/oauth/storage/saves/slot-1" \
  -H "Authorization: Bearer ACCESS_TOKEN"

Limits and errors

Each member's storage for one application is limited to 1 MiB of JSON per value, 8 MiB in total, and 100 keys by default. The list response reports the limits an installation actually enforces, so read usage before writing large saves.

Error	Meaning
invalid_request	The key is invalid, the body is not valid JSON, or it is nested too deeply.
object_too_large	The value is larger than the per-entry limit. HTTP 413.
storage_full	The member's storage for this application has no room left. HTTP 409.
not_found	No value is stored under that key. HTTP 404.
insufficient_scope	The token was not granted the storage scope. HTTP 403.

Member controls

Members can review the data each application saved for them in Settings → App storage. They can read every entry, delete one entry, or delete everything an application stored.

Revoking an application stops its tokens immediately, but its stored data remains available to the member in case they reconnect. Deleting the application removes all of its stored data.

For the sign-in flow, token exchange, and other scopes, see the OAuth guide.