Mobile App API
The Mobile App API lets an Android or iOS app of your own work with your Quran CMS site: members sign in from the app with their site account, and their bookmarks, last read ayah, learning progress and donation history are the same in the app and on the website.
It is a premium plugin.
Who it is for
Site owners who have, or are having built, a mobile app for their Quran website, and developers building one. The Quran, the translations, tafsir, audio, prayer times and search are already available to any app through the site's public JSON API; this plugin adds what an app needs for members: token sign-in, sign-up and the member's own data.
Switching it on
- Your licence must include the plugin. Without it, Admin → Plugins shows Mobile App API with a lock: Unlock opens the store at license.faruk.bd, and a key bought on its own (it starts with
QCMP-) can be added under Admin → License → Plugin & theme keys. Keys bought for your site are usually fitted automatically at the next licence check. - On Admin → Plugins turn Mobile App API on. It creates the table
qc_app_tokens. - Open Admin → Mobile App API (under Plugins in the menu).
The admin page
API reference
The address of your API (https://your-site/api/) and every request an app can make, in two groups.
Public — no sign-in
| Request | Answers |
|---|---|
GET app/config | Site name, logo, colours, languages, default translation, reciter and prayer settings |
GET app/home | Ayah of the day, the latest posts and the donation causes |
GET surahs | All 114 surahs with names, meanings and counts |
GET surah/{n}?tr=bn-taisirul,en-sahih&pr=bn-pron&from=1&to=20 | Ayahs of a surah with translations and pronunciation |
GET ayah/{surah}/{ayah}?tr=… | One ayah |
GET juz/{n}?tr=… | A whole juz |
GET translations · tafsirs · reciters | What is available |
GET tafsir/{code}/{surah}/{ayah} | Tafsir of one ayah |
GET audio/{reciter id}/{surah} | Audio addresses for every ayah of a surah |
GET prayer?lat=23.81&lng=90.41&tz=Asia/Dhaka&date=YYYY-MM-DD | Prayer, sunrise, sehri and iftar times |
GET search?q=… | Search the Quran |
POST app/login {email, password, device} | Sign in; answers a token |
POST app/register {name, email, password, device} | Create an account; answers a token |
Signed in — header Authorization: Bearer <token>
| Request | Does |
|---|---|
GET app/me | The member and their counts (bookmarks, lessons done, amount donated) |
GET app/bookmarks | Bookmarked ayahs with their text |
POST app/bookmarks {ayah, note} | Add a bookmark (ayah = ayah id 1–6236) |
POST app/bookmarks/delete {ayah} | Remove a bookmark |
GET app/reading / POST app/reading {ayah} | Read or save the last read ayah |
GET app/learning | Courses and lessons with the member's progress |
POST app/learning/done {lesson, done} | Mark a lesson finished (or not) |
GET app/donations | The member's donations with receipt links |
POST app/logout | Sign this device out |
Every answer is JSON with ok. Add ?lang=bn or ?lang=en for the language of the texts. The page shows two ready examples with curl:
curl -X POST https://your-site/api/app/login -H "Content-Type: application/json" -d '{"email":"you@example.com","password":"…","device":"Android"}'
curl https://your-site/api/app/bookmarks -H "Authorization: Bearer TOKEN"Signed-in devices
Every app sign-in, newest first: the member, the device name the app sent (for example Android 14 · Samsung Galaxy A54), when it was last used and when it expires. Sign out ends one device's session; Sign all out ends every app session at once — useful after a lost phone, or before changing the app's sign-in.
Settings
| Setting | What it does |
|---|---|
| App API on | Off: every app/… request answers The app API is switched off |
| Allow sign-up from the app | Also follows the site's own registration setting |
| Allow other sites and apps to call the API (CORS) | Needed for web apps on other domains; a native app does not need it |
| Stay signed in for (days) | How long an app token lasts, 1 to 3650 days (365 by default) |
How sign-in works
The app sends the member's e-mail (or username) and password to app/login. The site checks them exactly as the web sign-in does, with the same limits on repeated attempts, and answers a token of 48 characters. Only a fingerprint (SHA-256) of the token is stored, so the token cannot be read back from the database. The app sends it with every member request; when it expires or is signed out, the app shows its sign-in screen again.
A typical project
- Switch the plugin on and set Stay signed in for (days).
- Give your developer the address of the API and this chapter.
app/configtells the app your name, logo and colours, so one app build can follow your branding. - The app reads the Quran, audio and prayer times from the public requests, and signs members in with
app/login. - Watch Signed-in devices after the launch to see the app being used.
Tips
- Run the site on https: the app sends passwords to the API.
- When registration is closed on the site (or Allow sign-up from the app is off),
app/registeranswers Registration is closed; build the app so it hides the sign-up button whenapp/configsaysregistration_open: false. - If members donate in the app through a web page,
app/donationslists the same receipts they see on the website.