From c1c049d404d3491efb4918dc65db135671fe9a04 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Wed, 8 Oct 2025 10:52:37 -0700
Subject: display read-only token

---
 src/routes/(static)/docs/+page.server.ts |  5 ++++-
 src/routes/(static)/docs/+page.svelte    | 35 ++++++++++++++++++++++++++------
 2 files changed, 33 insertions(+), 7 deletions(-)

diff --git a/src/routes/(static)/docs/+page.server.ts b/src/routes/(static)/docs/+page.server.ts
index 86f95824..93ba544c 100644
--- a/src/routes/(static)/docs/+page.server.ts
+++ b/src/routes/(static)/docs/+page.server.ts
@@ -1,4 +1,7 @@
+import { auth, get } from "$lib/utils";
 export const load = async ({ cookies }) => {
 	const token = cookies.get("token");
-	return { token };
+	let ro;
+	if (token) ro = await get("/ro", auth(cookies));
+	return { ro, token };
 };
diff --git a/src/routes/(static)/docs/+page.svelte b/src/routes/(static)/docs/+page.svelte
index f53787e5..c323f9bd 100644
--- a/src/routes/(static)/docs/+page.svelte
+++ b/src/routes/(static)/docs/+page.svelte
@@ -7,7 +7,7 @@
 
   let { data } = $props();
 
-  let { user, token } = data;
+  let { user, ro, token } = data;
 
   let api = PUBLIC_DOMAIN.includes("localhost")
     ? `${PUBLIC_COINOS_URL}`
@@ -16,6 +16,8 @@
   let tokenSample = token
     ? `export token="${token}"`
     : `export token=<your auth token>`;
+
+  let roSample = `export token="${ro}"`;
 </script>
 
 {#snippet cp(something)}
@@ -59,7 +61,7 @@
       or get one from the /login endpoint.
     {/if}
 
-    Save it in a variable called <b>$token</b> to run the examples.
+    Save it in a variable called <b>$token</b> to run the examples. It gives full access to your account so keep it safe.
   </p>
 
   <div
@@ -69,6 +71,19 @@
     {@render cp(tokenSample)}
   </div>
 
+  {#if ro}
+    <p class="text-secondary">
+      This read-only token has permission to create invoices and fetch
+      payments but can't be used to make withdrawals
+    </p>
+    <div
+      class="bg-primary text-primary-content rounded-lg p-4 flex gap-4 items-center"
+    >
+      <div class="w-full break-all">{roSample}</div>
+      {@render cp(roSample)}
+    </div>
+  {/if}
+
   <h2 class="text-2xl">POST /register</h2>
   <p class="text-secondary">
     Register a new user account with a username and password
@@ -92,9 +107,13 @@
     <div class="font-bold">display</div>
     <div class="col-span-2">string - spaces allowed</div>
     <div class="font-bold">currency</div>
-    <div class="col-span-2">string - three-letter ISO currency code e.g. CAD or USD</div>
+    <div class="col-span-2">
+      string - three-letter ISO currency code e.g. CAD or USD
+    </div>
     <div class="font-bold">language</div>
-    <div class="col-span-2">string - two-letter language code e.g. en, fr, es</div>
+    <div class="col-span-2">
+      string - two-letter language code e.g. en, fr, es
+    </div>
   </div>
 
   <Code sample="update" />
@@ -108,7 +127,9 @@
       <div class="font-bold">type (string, default: lightning)</div>
       <div class="col-span-2">bitcoin or lightning</div>
       <div class="font-bold">fiat (boolean, default: false)</div>
-      <div class="col-span-2">whether the amount is denominated in satoshis or local currency</div>
+      <div class="col-span-2">
+        whether the amount is denominated in satoshis or local currency
+      </div>
       <div class="font-bold">amount (numeric)</div>
       <div class="col-span-2">amount to be paid</div>
       <div class="font-bold">webhook (string, optional)</div>
@@ -116,7 +137,9 @@
         remote endpoint to call when the invoice is paid
       </div>
       <div class="font-bold">secret (string, optional)</div>
-      <div class="col-span-2">a secret value passed to the webhook to authenticate the request</div>
+      <div class="col-span-2">
+        a secret value passed to the webhook to authenticate the request
+      </div>
     </div>
   </div>
 
-- 
cgit v1.2.3