Build on InRealLife

1. Connect

A connection is one person, in one app: Hangout or Bondable. It uses OAuth 2.1 with PKCE (S256). There are no API keys, no secrets and no company accounts.

1. Discover. GET /.well-known/oauth-authorization-server lists every address below.
2. Register your tool, once: POST /oauth/register with client_name and redirect_uris. You get a client_id.
3. Send the person to sign in at /oauth/authorize, with response_type=code, your client_id and redirect_uri, a scope, a state, and a code_challenge with code_challenge_method=S256. They type their email, then tap Allow in Hangout or Bondable on their phone. No phone handy? They can use a code sent by email.
4. Swap the code for tokens at POST /oauth/token with your code_verifier. An access token lasts an hour; each refresh token works once.

The scope is one of:

• see: activities nearby, one activity, the person's plans, activity types.
• see join, shown to the person as "Plan for me": all that, plus prepare an activity, ask to join, leave, and tell the group where you are.

The person sees every connected tool in the app, under Account → Connected apps, with a log of its actions. Disconnecting it there immediately revokes its tokens.

Terminals use the device flow: your tool shows a code; the person types it in the app.

2. Find

curl 'https://api.inreallife.technology/v1/activities?latitude=48.8566&longitude=2.3522' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Up to ten upcoming activities, within 25 km unless you set radius_km, and within 100 km of the person's area: GET /v1/area says where that is. Then GET /v1/activities/{id} for one, and GET /v1/schedule for the person's plans.

3. Prepare and ask to join

Your tool never publishes or joins. It prepares, IRL runs the same checks as it would for publishing or joining, and only then gives back a link. The person opens it on their phone and taps Publish or Join. That tap is the commitment.

curl https://api.inreallife.technology/v1/prepared_activities \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' -H 'Content-Type: application/json' \
  -d '{"activity": {"type": "games", "title": "Board game night", "starts_at": "2026-11-06T19:30:00+01:00",
       "venue_name": "Le Dernier Bar", "address": "…", "area": "Bastille", "city": "Paris",
       "country_code": "FR", "latitude": 48.853, "longitude": 2.369, "max_participants": 6}}'

• Refused: an error code and a message that says what to fix (too_far, invalid with each field…), and no link.
• Checks passed: {"url": "https://hangout.inreallife.technology/go/…", "expires_at": "…"}. Give the person the link as is: it works once, for 15 minutes, and only for them.
• One prepared activity per person: a new one replaces the last.
• POST /v1/activities/{id}/join_link does the same for joining: the checks run immediately, but participation is confirmed only when the person taps Join.

On MCP, the same tools: my_area, my_schedule, prepare_activity, join_activity, leave_activity, send_signal.