Login methods for your server

CorbaTime premium connects to a URL on your own web server and authenticates every request in one of two ways: a bearer token in the Authentication header, or a username and password sent as POST fields. Your server checks the credentials and always replies with JSON.

Last updated: 15 October 2026

Settings in the app

Once you have unlocked the premium membership in the App Store, CorbaTime shows these settings for connecting to your web server:

• URL: the address of the script on your server that the app sends its requests to, for example https://www.example.com/api.php. Use an https:// URL so your credentials are encrypted in transit.
• Method: bearer token, or username and password (see below).

The two login methods

Request format

Every request from the app is an HTTP POST with an application/x-www-form-urlencoded body. The POST field action tells your server what to do: get_clients (Step 2) or push_timer (Step 3).

Example request with a bearer token:

curl -X POST https://www.example.com/api.php \
  -H "Authentication: Bearer my-secret-token" \
  -d "action=get_clients"

Example request with username and password:

curl -X POST https://www.example.com/api.php \
  -d "action=get_clients" \
  -d "username=corbatime" \
  -d "password=my-password"

Responding to a failed login

Check the login details on your server first. If they are correct, handle the requested action (see Step 2 and Step 3). If they are not, reply with a JSON error, preferably with HTTP status 401:

{"error":"Invalid login"}

The app treats any status outside the 2xx range as an error and shows the text of the error key to the user.

All your client information will be stored in iCloud, so the privacy of you and your clients is safe. No data is sent to our webservers, the only communication is between the app and your server, or between the app and your private iCloud.