Zorveus Documentation

Allow users to connect their Zorveus AI wallet to your application using Authorization Code with PKCE.

If you build developer tools, IDE extensions, or SaaS platforms where users bring their own AI funding, you can use Zorveus OAuth 2.0 with PKCE (Proof Key for Code Exchange).

Interactive Flow Visualizer

OAuth 2.0 Authorization Code with PKCE Flow

Step 1 of 6: Click next or select a step below to inspect the interaction.

User Browser

Developer App Backend

Zorveus Auth Server

Zorveus Consent UI

1. Generate code_verifier & challenge

App creates cryptographic code_verifier, hashes it with SHA-256 to create code_challenge, and sets state.

From: Developer App Backend➔To: User Browser

1. App Registration

In app.zorveus.com, create or select a Developer Organization.
Create an application and specify your registered Redirect URIs (e.g. https://myapp.com/api/auth/callback/zorveus).
Note your Client ID (zrv_client_...) and initial Client Secret (zrv_client_secret_...).

2. Step-by-Step PKCE Implementation

Generate Code Verifier and Code Challenge

Create a high-entropy cryptographic random string (code_verifier) between 43 and 128 characters, then hash it with SHA-256 and Base64URL-encode the output (code_challenge).

Redirect User to Authorization Screen

Navigate the user's browser to the Zorveus consent endpoint:

https://app.zorveus.com/oauth/authorize?response_type=code&client_id=zrv_client_your_client_id&redirect_uri=https%3A%2F%2Fmyapp.com%2Fcallback&scope=inference%3Awrite&code_challenge=E9Melhoa2OwvFrGMTJguCH5ZiXV6lURbI7...&code_challenge_method=S256&state=random_state_string

User Grants Consent

The user signs in to Zorveus, selects their funding organization (personal or team), and sets an optional spending cap.

Exchange Code for Scoped Inference Token

Upon redirect to your redirect_uri with ?code=...&state=..., your backend makes a server-to-server POST request to exchange the code for an inference token:

3. Server-Side Token Exchange

Your backend exchanges the short-lived authorization code using the plaintext code_verifier:

async function exchangeCodeForToken(code: string, codeVerifier: string) {
  const response = await fetch("https://api.zorveus.com/oauth/token", {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded",
    },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      client_id: "zrv_client_your_client_id",
      client_secret: "zrv_client_secret_your_client_secret",
      code: code,
      code_verifier: codeVerifier,
      redirect_uri: "https://myapp.com/callback",
    }),
  });

  const data = await response.json();
  // Returns { access_token: "zrv_...", token_type: "Bearer", expires_in: ... }
  return data.access_token;
}

4. Make Inference with the Scoped Token

The resulting access_token (zrv_...) is a standard Zorveus inference key scoped strictly to the user's selected organization, allowed models, and spending cap.

from openai import OpenAI

# Use the token obtained from OAuth token exchange
user_oauth_token = "zrv_..."

client = OpenAI(
    base_url="https://api.zorveus.com/v1",
    api_key=user_oauth_token,
)

response = client.chat.completions.create(
    model="openai/gpt-4.1-mini",
    messages=[{"role": "user", "content": "Generate a weekly team standup update."}],
)

print(response.choices[0].message.content)

Next Steps

OAuth Architecture Deep Dive

Read the full OAuth reference covering reauthorization, scopes, and revocation.

Publishing & App Review

Understand the lifecycle from Draft apps to Public Verified status.

Was this page helpful?

Edit this page on GitHub

OAuth App Quickstart