---
title: OAuth 2.0 overview
description: Actors, returned data, and the authorization-code PKCE flow for connectable AI applications.
---

Zorveus uses the OAuth 2.0 authorization code flow with S256 PKCE to let an application request scoped inference access funded by a user-selected organization.

---

## Three-step lifecycle

| Step | Action | Description |
| :--- | :--- | :--- |
| **1. Authorize** | User Consent | User is redirected to Zorveus to choose their funding organization and approve your requested scopes. |
| **2. Exchange** | PKCE Token Swap | Your backend exchanges the authorization code + cryptographic `code_verifier` for a scoped inference token. |
| **3. Inference** | AI Completions | Your application sends standard inference calls to `https://api.zorveus.com/v1` using that token. |

---

## Data returned to the client

When a user authorizes your app via OAuth:
- The token response contains the access token, token type, scopes, app connection ID, expiry when applicable, and inference API base URL.
- It does not return the selected organization’s stored provider credentials or wallet balance.
- The user can inspect and revoke the connection from the Zorveus dashboard.

---

## OAuth actors

1. **Client / App Developer**: The application initiating authorization and exchanging tokens.
2. **Resource Owner / Payer**: The user granting access and choosing which personal or team wallet funds the inference.
3. **Authorization Server**: Zorveus OAuth endpoints (`/oauth/authorize`, `/oauth/token`).
4. **Resource Server**: The Zorveus Inference Gateway (`https://api.zorveus.com/v1`).