@oxyhq/core 1.5.0 → 1.6.0

package/dist/cjs/mixins/OxyServices.user.js

@@ -12,7 +12,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getProfileByUsername(username) {
             try {
-                return await this.makeRequest('GET', `/api/profiles/username/${username}`, undefined, {
+                return await this.makeRequest('GET', `/profiles/username/${username}`, undefined, {
                     cache: true,
                     cacheTTL: 5 * 60 * 1000, // 5 minutes cache for profiles
                 });
@@ -29,7 +29,7 @@ function OxyServicesUserMixin(Base) {
                 const params = { query, ...pagination };
                 const searchParams = (0, apiUtils_1.buildSearchParams)(params);
                 const paramsObj = Object.fromEntries(searchParams.entries());
-                const response = await this.makeRequest('GET', '/api/profiles/search', paramsObj, {
+                const response = await this.makeRequest('GET', '/profiles/search', paramsObj, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000, // 2 minutes cache
                 });
@@ -74,7 +74,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getProfileRecommendations() {
             return this.withAuthRetry(async () => {
-                return await this.makeRequest('GET', '/api/profiles/recommendations', undefined, { cache: true });
+                return await this.makeRequest('GET', '/profiles/recommendations', undefined, { cache: true });
             }, 'getProfileRecommendations');
         }
         /**
@@ -82,7 +82,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getUserById(userId) {
             try {
-                return await this.makeRequest('GET', `/api/users/${userId}`, undefined, {
+                return await this.makeRequest('GET', `/users/${userId}`, undefined, {
                     cache: true,
                     cacheTTL: 5 * 60 * 1000, // 5 minutes cache
                 });
@@ -96,7 +96,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getCurrentUser() {
             return this.withAuthRetry(async () => {
-                return await this.makeRequest('GET', '/api/users/me', undefined, {
+                return await this.makeRequest('GET', '/users/me', undefined, {
                     cache: true,
                     cacheTTL: 1 * 60 * 1000, // 1 minute cache for current user
                 });
@@ -108,7 +108,7 @@ function OxyServicesUserMixin(Base) {
          */
         async updateProfile(updates) {
             try {
-                return await this.makeRequest('PUT', '/api/users/me', updates, { cache: false });
+                return await this.makeRequest('PUT', '/users/me', updates, { cache: false });
             }
             catch (error) {
                 const errorAny = error;
@@ -134,7 +134,7 @@ function OxyServicesUserMixin(Base) {
         async getPrivacySettings(userId) {
             try {
                 const id = userId || (await this.getCurrentUser()).id;
-                return await this.makeRequest('GET', `/api/privacy/${id}/privacy`, undefined, {
+                return await this.makeRequest('GET', `/privacy/${id}/privacy`, undefined, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000, // 2 minutes cache
                 });
@@ -151,7 +151,7 @@ function OxyServicesUserMixin(Base) {
         async updatePrivacySettings(settings, userId) {
             try {
                 const id = userId || (await this.getCurrentUser()).id;
-                return await this.makeRequest('PATCH', `/api/privacy/${id}/privacy`, settings, {
+                return await this.makeRequest('PATCH', `/privacy/${id}/privacy`, settings, {
                     cache: false,
                 });
             }
@@ -164,7 +164,7 @@ function OxyServicesUserMixin(Base) {
          */
         async requestAccountVerification(reason, evidence) {
             try {
-                return await this.makeRequest('POST', '/api/users/verify/request', {
+                return await this.makeRequest('POST', '/users/verify/request', {
                     reason,
                     evidence,
                 }, { cache: false });
@@ -181,7 +181,7 @@ function OxyServicesUserMixin(Base) {
                 // Use httpService for blob responses (it handles blob responses automatically)
                 const result = await this.getClient().request({
                     method: 'GET',
-                    url: `/api/users/me/data`,
+                    url: `/users/me/data`,
                     params: { format },
                     cache: false,
                 });
@@ -198,7 +198,7 @@ function OxyServicesUserMixin(Base) {
          */
         async deleteAccount(password, confirmText) {
             try {
-                return await this.makeRequest('DELETE', '/api/users/me', {
+                return await this.makeRequest('DELETE', '/users/me', {
                     password,
                     confirmText,
                 }, { cache: false });
@@ -212,7 +212,7 @@ function OxyServicesUserMixin(Base) {
          */
         async followUser(userId) {
             try {
-                return await this.makeRequest('POST', `/api/users/${userId}/follow`, undefined, { cache: false });
+                return await this.makeRequest('POST', `/users/${userId}/follow`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -223,7 +223,7 @@ function OxyServicesUserMixin(Base) {
          */
         async unfollowUser(userId) {
             try {
-                return await this.makeRequest('DELETE', `/api/users/${userId}/follow`, undefined, { cache: false });
+                return await this.makeRequest('DELETE', `/users/${userId}/follow`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -234,7 +234,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getFollowStatus(userId) {
             try {
-                return await this.makeRequest('GET', `/api/users/${userId}/follow-status`, undefined, {
+                return await this.makeRequest('GET', `/users/${userId}/follow-status`, undefined, {
                     cache: true,
                     cacheTTL: 1 * 60 * 1000, // 1 minute cache
                 });
@@ -249,7 +249,7 @@ function OxyServicesUserMixin(Base) {
         async getUserFollowers(userId, pagination) {
             try {
                 const params = (0, apiUtils_1.buildPaginationParams)(pagination || {});
-                const response = await this.makeRequest('GET', `/api/users/${userId}/followers`, params, {
+                const response = await this.makeRequest('GET', `/users/${userId}/followers`, params, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000, // 2 minutes cache
                 });
@@ -269,7 +269,7 @@ function OxyServicesUserMixin(Base) {
         async getUserFollowing(userId, pagination) {
             try {
                 const params = (0, apiUtils_1.buildPaginationParams)(pagination || {});
-                const response = await this.makeRequest('GET', `/api/users/${userId}/following`, params, {
+                const response = await this.makeRequest('GET', `/users/${userId}/following`, params, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000, // 2 minutes cache
                 });
@@ -288,7 +288,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getNotifications() {
             return this.withAuthRetry(async () => {
-                return await this.makeRequest('GET', '/api/notifications', undefined, {
+                return await this.makeRequest('GET', '/notifications', undefined, {
                     cache: false, // Don't cache notifications - always get fresh data
                 });
             }, 'getNotifications');
@@ -298,7 +298,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getUnreadCount() {
             try {
-                const res = await this.makeRequest('GET', '/api/notifications/unread-count', undefined, {
+                const res = await this.makeRequest('GET', '/notifications/unread-count', undefined, {
                     cache: false, // Don't cache unread count - always get fresh data
                 });
                 return res.count;
@@ -312,7 +312,7 @@ function OxyServicesUserMixin(Base) {
          */
         async createNotification(data) {
             try {
-                return await this.makeRequest('POST', '/api/notifications', data, { cache: false });
+                return await this.makeRequest('POST', '/notifications', data, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -323,7 +323,7 @@ function OxyServicesUserMixin(Base) {
          */
         async markNotificationAsRead(notificationId) {
             try {
-                await this.makeRequest('PUT', `/api/notifications/${notificationId}/read`, undefined, { cache: false });
+                await this.makeRequest('PUT', `/notifications/${notificationId}/read`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -334,7 +334,7 @@ function OxyServicesUserMixin(Base) {
          */
         async markAllNotificationsAsRead() {
             try {
-                await this.makeRequest('PUT', '/api/notifications/read-all', undefined, { cache: false });
+                await this.makeRequest('PUT', '/notifications/read-all', undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -345,7 +345,7 @@ function OxyServicesUserMixin(Base) {
          */
         async deleteNotification(notificationId) {
             try {
-                await this.makeRequest('DELETE', `/api/notifications/${notificationId}`, undefined, { cache: false });
+                await this.makeRequest('DELETE', `/notifications/${notificationId}`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);

package/dist/cjs/mixins/OxyServices.utility.js

@@ -52,7 +52,7 @@ function OxyServicesUtilityMixin(Base) {
          */
         async fetchLinkMetadata(url) {
             try {
-                return await this.makeRequest('GET', '/api/link-metadata', { url }, {
+                return await this.makeRequest('GET', '/link-metadata', { url }, {
                     cache: true,
                     cacheTTL: mixinHelpers_1.CACHE_TIMES.EXTRA_LONG,
                 });
@@ -73,19 +73,19 @@ function OxyServicesUtilityMixin(Base) {
          *
          * const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
          *
-         * // Protect all routes under /api/protected
-         * app.use('/api/protected', oxy.auth());
+         * // Protect all routes under /protected
+         * app.use('/protected', oxy.auth());
          *
          * // Access user in route handler
-         * app.get('/api/protected/me', (req, res) => {
+         * app.get('/protected/me', (req, res) => {
          *   res.json({ userId: req.userId, user: req.user });
          * });
          *
          * // Load full user profile from API
-         * app.use('/api/admin', oxy.auth({ loadUser: true }));
+         * app.use('/admin', oxy.auth({ loadUser: true }));
          *
          * // Optional auth - attach user if present, don't block if absent
-         * app.use('/api/public', oxy.auth({ optional: true }));
+         * app.use('/public', oxy.auth({ optional: true }));
          * ```
          *
          * @param options Optional configuration
@@ -187,7 +187,16 @@ function OxyServicesUtilityMixin(Base) {
                                 throw new Error('Invalid signature');
                             }
                         }
-                        catch {
+                        catch (verifyError) {
+                            const isSignatureError = verifyError instanceof Error &&
+                                (verifyError.message === 'Invalid signature' || verifyError.message === 'Invalid token structure');
+                            if (!isSignatureError) {
+                                console.error('[oxy.auth] Unexpected error during service token verification:', verifyError);
+                                const error = { message: 'Internal authentication error', code: 'AUTH_INTERNAL_ERROR', status: 500 };
+                                if (onError)
+                                    return onError(error);
+                                return res.status(500).json(error);
+                            }
                             if (optional) {
                                 req.userId = null;
                                 req.user = null;

package/dist/cjs/utils/platform.js

@@ -12,6 +12,8 @@ exports.isWeb = isWeb;
 exports.isNative = isNative;
 exports.isIOS = isIOS;
 exports.isAndroid = isAndroid;
+exports.isReactNative = isReactNative;
+exports.isNodeJS = isNodeJS;
 exports.setPlatformOS = setPlatformOS;
 /**
  * Detect the current platform without importing react-native
@@ -82,6 +84,18 @@ function isIOS() {
 function isAndroid() {
     return getPlatformOS() === 'android';
 }
+/**
+ * Check if running in React Native
+ */
+function isReactNative() {
+    return typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
+}
+/**
+ * Check if running in Node.js
+ */
+function isNodeJS() {
+    return typeof process !== 'undefined' && process.versions != null && process.versions.node != null;
+}
 /**
  * Set the platform OS explicitly
  * Called by React Native entry point to register the platform

package/dist/esm/AuthManager.js

@@ -243,7 +243,7 @@ export class AuthManager {
                 // Use session-based token endpoint which handles auto-refresh server-side
                 const response = await httpService.request({
                     method: 'GET',
-                    url: `/api/session/token/${sessionId}`,
+                    url: `/session/token/${sessionId}`,
                     cache: false,
                     retry: false,
                 });

package/dist/esm/HttpService.js

@@ -25,7 +25,9 @@ import { isNative, getPlatformOS } from './utils/platform';
  */
 const isNativeApp = isNative();
 /**
- * Token store for authentication (singleton)
+ * Token store for authentication (instance-based)
+ * Each HttpService gets its own TokenStore to prevent conflicts
+ * when multiple OxyServices instances coexist server-side.
  */
 class TokenStore {
     constructor() {
@@ -34,12 +36,6 @@ class TokenStore {
         this.csrfToken = null;
         this.csrfTokenFetchPromise = null;
     }
-    static getInstance() {
-        if (!TokenStore.instance) {
-            TokenStore.instance = new TokenStore();
-        }
-        return TokenStore.instance;
-    }
     setTokens(accessToken, refreshToken = '') {
         this.accessToken = accessToken;
         this.refreshToken = refreshToken;
@@ -83,6 +79,7 @@ class TokenStore {
 export class HttpService {
     constructor(config) {
         this.tokenRefreshPromise = null;
+        this.tokenRefreshCooldownUntil = 0;
         this._onTokenRefreshed = null;
         // Performance monitoring
         this.requestMetrics = {
@@ -95,7 +92,7 @@ export class HttpService {
         };
         this.config = config;
         this.baseURL = config.baseURL;
-        this.tokenStore = TokenStore.getInstance();
+        this.tokenStore = new TokenStore();
         this.logger = new SimpleLogger(config.enableLogging || false, config.logLevel || 'error', 'HttpService');
         // Initialize performance infrastructure
         this.cache = new TTLCache(config.cacheTTL || 5 * 60 * 1000);
@@ -247,6 +244,20 @@ export class HttpService {
                         // Refresh failed or no token — clear tokens
                         this.tokenStore.clearTokens();
                     }
+                    // On 403 with CSRF error, clear cached token and retry once
+                    if (response.status === 403 && !config._isCsrfRetry) {
+                        try {
+                            const clonedResponse = response.clone();
+                            const errBody = await clonedResponse.json();
+                            if (errBody?.code === 'CSRF_TOKEN_INVALID' || errBody?.code === 'CSRF_TOKEN_MISSING') {
+                                this.tokenStore.clearCsrfToken();
+                                return this.request({ ...config, _isCsrfRetry: true, retry: false });
+                            }
+                        }
+                        catch {
+                            // Failed to parse error body — not a CSRF error
+                        }
+                    }
                     // Try to parse error response (handle empty/malformed JSON)
                     let errorMessage = `HTTP ${response.status}: ${response.statusText}`;
                     const contentType = response.headers.get('content-type');
@@ -403,52 +414,57 @@ export class HttpService {
             return existingPromise;
         }
         const fetchPromise = (async () => {
-            try {
-                if (isDev())
-                    console.log('[HttpService] Fetching CSRF token from:', `${this.baseURL}/api/csrf-token`);
-                // Use AbortController for timeout (more compatible than AbortSignal.timeout)
-                const controller = new AbortController();
-                const timeoutId = setTimeout(() => controller.abort(), 5000);
-                const response = await fetch(`${this.baseURL}/api/csrf-token`, {
-                    method: 'GET',
-                    headers: { 'Accept': 'application/json' },
-                    credentials: 'include', // Required to receive and send cookies
-                    signal: controller.signal,
-                });
-                clearTimeout(timeoutId);
-                if (isDev())
-                    console.log('[HttpService] CSRF fetch response:', response.status, response.ok);
-                if (response.ok) {
-                    const data = await response.json();
+            const maxAttempts = 2;
+            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+                try {
+                    if (isDev())
+                        console.log('[HttpService] Fetching CSRF token from:', `${this.baseURL}/csrf-token`, `(attempt ${attempt})`);
+                    // Use AbortController for timeout (more compatible than AbortSignal.timeout)
+                    const controller = new AbortController();
+                    const timeoutId = setTimeout(() => controller.abort(), 5000);
+                    const response = await fetch(`${this.baseURL}/csrf-token`, {
+                        method: 'GET',
+                        headers: { 'Accept': 'application/json' },
+                        credentials: 'include', // Required to receive and send cookies
+                        signal: controller.signal,
+                    });
+                    clearTimeout(timeoutId);
+                    if (isDev())
+                        console.log('[HttpService] CSRF fetch response:', response.status, response.ok);
+                    if (response.ok) {
+                        const data = await response.json();
+                        if (isDev())
+                            console.log('[HttpService] CSRF response data:', data);
+                        const token = data.csrfToken || null;
+                        this.tokenStore.setCsrfToken(token);
+                        this.logger.debug('CSRF token fetched');
+                        return token;
+                    }
+                    // Also check response header for CSRF token
+                    const headerToken = response.headers.get('X-CSRF-Token');
+                    if (headerToken) {
+                        this.tokenStore.setCsrfToken(headerToken);
+                        this.logger.debug('CSRF token from header');
+                        return headerToken;
+                    }
                     if (isDev())
-                        console.log('[HttpService] CSRF response data:', data);
-                    const token = data.csrfToken || null;
-                    this.tokenStore.setCsrfToken(token);
-                    this.logger.debug('CSRF token fetched');
-                    return token;
+                        console.log('[HttpService] CSRF fetch failed with status:', response.status);
+                    this.logger.warn('Failed to fetch CSRF token:', response.status);
                 }
-                // Also check response header for CSRF token
-                const headerToken = response.headers.get('X-CSRF-Token');
-                if (headerToken) {
-                    this.tokenStore.setCsrfToken(headerToken);
-                    this.logger.debug('CSRF token from header');
-                    return headerToken;
+                catch (error) {
+                    if (isDev())
+                        console.log('[HttpService] CSRF fetch error:', error);
+                    this.logger.warn('CSRF token fetch error:', error);
+                }
+                // Wait before retry (500ms)
+                if (attempt < maxAttempts) {
+                    await new Promise(resolve => setTimeout(resolve, 500));
                 }
-                if (isDev())
-                    console.log('[HttpService] CSRF fetch failed with status:', response.status);
-                this.logger.warn('Failed to fetch CSRF token:', response.status);
-                return null;
-            }
-            catch (error) {
-                if (isDev())
-                    console.log('[HttpService] CSRF fetch error:', error);
-                this.logger.warn('CSRF token fetch error:', error);
-                return null;
-            }
-            finally {
-                this.tokenStore.setCsrfTokenFetchPromise(null);
             }
-        })();
+            return null;
+        })().finally(() => {
+            this.tokenStore.setCsrfTokenFetchPromise(null);
+        });
         this.tokenStore.setCsrfTokenFetchPromise(fetchPromise);
         return fetchPromise;
     }
@@ -465,18 +481,25 @@ export class HttpService {
             const currentTime = Math.floor(Date.now() / 1000);
             // If token expires in less than 60 seconds, refresh it
             if (decoded.exp && decoded.exp - currentTime < 60 && decoded.sessionId) {
-                // Deduplicate concurrent refresh attempts
-                if (!this.tokenRefreshPromise) {
-                    this.tokenRefreshPromise = this._refreshTokenFromSession(decoded.sessionId);
+                // Skip if we recently failed a refresh (5s cooldown to prevent storms)
+                if (Date.now() < this.tokenRefreshCooldownUntil) {
+                    return `Bearer ${accessToken}`;
                 }
-                try {
-                    const result = await this.tokenRefreshPromise;
-                    if (result)
+                // Deduplicate concurrent refresh attempts. The promise is shared
+                // across all concurrent callers and cleared only after it settles,
+                // so every awaiter receives the same result.
+                if (!this.tokenRefreshPromise) {
+                    this.tokenRefreshPromise = this._refreshTokenFromSession(decoded.sessionId)
+                        .then((result) => {
+                        if (!result)
+                            this.tokenRefreshCooldownUntil = Date.now() + 5000;
                         return result;
+                    })
+                        .finally(() => { this.tokenRefreshPromise = null; });
                 }
-                finally {
-                    this.tokenRefreshPromise = null;
-                }
+                const result = await this.tokenRefreshPromise;
+                if (result)
+                    return result;
             }
             return `Bearer ${accessToken}`;
         }
@@ -487,7 +510,7 @@ export class HttpService {
     }
     async _refreshTokenFromSession(sessionId) {
         try {
-            const refreshUrl = `${this.baseURL}/api/session/token/${sessionId}`;
+            const refreshUrl = `${this.baseURL}/session/token/${sessionId}`;
             const response = await fetch(refreshUrl, {
                 method: 'GET',
                 headers: { 'Accept': 'application/json' },
@@ -640,14 +663,9 @@ export class HttpService {
     getMetrics() {
         return { ...this.requestMetrics };
     }
-    // Test-only utility
-    static __resetTokensForTests() {
-        try {
-            TokenStore.getInstance().clearTokens();
-        }
-        catch (error) {
-            // Silently fail in test cleanup - this is expected behavior
-            // TokenStore might not be initialized in some test scenarios
-        }
+    // Test-only utility — clears tokens on this instance
+    __resetTokensForTests() {
+        this.tokenStore.clearTokens();
+        this.tokenStore.clearCsrfToken();
     }
 }

package/dist/esm/OxyServices.base.js

@@ -23,9 +23,10 @@ export class OxyServicesBase {
         // Initialize unified HTTP service (handles auth, caching, deduplication, queuing, retry)
         this.httpService = new HttpService(config);
     }
-    // Test-only utility to reset global tokens between jest tests
-    static __resetTokensForTests() {
-        HttpService.__resetTokensForTests();
+    // Test-only utility to reset tokens on this instance between jest tests
+    // Note: tokens are now per-instance, so create new instances in tests for isolation
+    __resetTokensForTests() {
+        this.httpService.__resetTokensForTests();
     }
     /**
      * Make a request with all performance optimizations
@@ -231,7 +232,7 @@ export class OxyServicesBase {
             return false;
         }
         try {
-            const res = await this.makeRequest('GET', '/api/auth/validate', undefined, {
+            const res = await this.makeRequest('GET', '/auth/validate', undefined, {
                 cache: false,
                 retry: false,
             });

package/dist/esm/crypto/keyManager.js

@@ -5,7 +5,7 @@
  * Private keys are stored securely using expo-secure-store and never leave the device.
  */
 import { ec as EC } from 'elliptic';
-import { isWeb, isIOS, isAndroid } from '../utils/platform';
+import { isWeb, isIOS, isAndroid, isReactNative, isNodeJS } from '../utils/platform';
 import { logger } from '../utils/loggerUtils';
 import { isDev } from '../shared/utils/debugUtils';
 // Lazy imports for React Native specific modules
@@ -56,18 +56,6 @@ async function initSecureStore() {
     }
     return SecureStore;
 }
-/**
- * Check if we're in a React Native environment
- */
-function isReactNative() {
-    return typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
-}
-/**
- * Check if we're in a Node.js environment
- */
-function isNodeJS() {
-    return typeof process !== 'undefined' && process.versions != null && process.versions.node != null;
-}
 /**
  * Check if we're on web platform
  * Identity storage is only available on native platforms (iOS/Android)

package/dist/esm/crypto/signatureService.js

@@ -6,21 +6,10 @@
  */
 import { ec as EC } from 'elliptic';
 import { KeyManager } from './keyManager';
+import { isReactNative, isNodeJS } from '../utils/platform';
 // Lazy import for expo-crypto
 let ExpoCrypto = null;
 const ec = new EC('secp256k1');
-/**
- * Check if we're in a React Native environment
- */
-function isReactNative() {
-    return typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
-}
-/**
- * Check if we're in a Node.js environment
- */
-function isNodeJS() {
-    return typeof process !== 'undefined' && process.versions != null && process.versions.node != null;
-}
 /**
  * Initialize expo-crypto module
  */
@@ -44,9 +33,7 @@ async function sha256(message) {
     // In Node.js, use Node's crypto module
     if (isNodeJS()) {
         try {
-            // eslint-disable-next-line @typescript-eslint/no-implied-eval
-            const getCrypto = new Function('return require("crypto")');
-            const nodeCrypto = getCrypto();
+            const nodeCrypto = await import('crypto');
             return nodeCrypto.createHash('sha256').update(message).digest('hex');
         }
         catch {

package/dist/esm/mixins/OxyServices.analytics.js

@@ -11,7 +11,7 @@ export function OxyServicesAnalyticsMixin(Base) {
          */
         async trackEvent(eventName, properties) {
             try {
-                await this.makeRequest('POST', '/api/analytics/events', {
+                await this.makeRequest('POST', '/analytics/events', {
                     event: eventName,
                     properties
                 }, { cache: false, retry: false }); // Don't retry analytics events
@@ -33,7 +33,7 @@ export function OxyServicesAnalyticsMixin(Base) {
                     params.startDate = startDate;
                 if (endDate)
                     params.endDate = endDate;
-                return await this.makeRequest('GET', '/api/analytics', params, {
+                return await this.makeRequest('GET', '/analytics', params, {
                     cache: true,
                     cacheTTL: CACHE_TIMES.LONG,
                 });