Reference

Consent screen. client_id, redirect_uri, scope, state, code_challenge, code_challenge_method=S256.

grant_type=authorization_code only → { access_token, token_type, expires_in, scope }. Code lives 5 minutes, single use.

→ { id, handle, display_name, image, entitlement? }.

→ { product_id, user_id, active, type, source, ends_at, test_mode }.

{ user_id, kind: session|heartbeat|activity } → { ok, counted, qualifying, test_mode }. With gk_…, usage is recorded only for someone currently signed in to your product with Shin ID or holding an entitlement to it (otherwise counted: false with a reason), and is never qualifying. With the person's gat_… token, user_id is not sent and the report qualifies.

Buy with Guiru from your own site. Availability is checked server-side; the checkout is the store's. See the buy link.

The On Guiru badge as SVG; says *Not listed* the moment that becomes true.

{ id, event, created_at, data }. Seven events (six real, plus webhook.test), at-least-once, 1m/5m/30m/2h/12h backoff.

Liveness. /api/ready additionally checks the database.