OAuth Integration
OAuth 2.0 overview
Actors, returned data, and the authorization-code PKCE flow for connectable AI applications.
Zorveus uses the OAuth 2.0 authorization code flow with S256 PKCE to let an application request scoped inference access funded by a user-selected organization.
Three-step lifecycle
| Step | Action | Description |
|---|---|---|
| 1. Authorize | User Consent | User is redirected to Zorveus to choose their funding organization and approve your requested scopes. |
| 2. Exchange | PKCE Token Swap | Your backend exchanges the authorization code + cryptographic code_verifier for a scoped inference token. |
| 3. Inference | AI Completions | Your application sends standard inference calls to https://api.zorveus.com/v1 using that token. |
Data returned to the client
When a user authorizes your app via OAuth:
- The token response contains the access token, token type, scopes, app connection ID, expiry when applicable, and inference API base URL.
- It does not return the selected organization’s stored provider credentials or wallet balance.
- The user can inspect and revoke the connection from the Zorveus dashboard.
OAuth actors
- Client / App Developer: The application initiating authorization and exchanging tokens.
- Resource Owner / Payer: The user granting access and choosing which personal or team wallet funds the inference.
- Authorization Server: Zorveus OAuth endpoints (
/oauth/authorize,/oauth/token). - Resource Server: The Zorveus Inference Gateway (
https://api.zorveus.com/v1).
Was this page helpful?
Edit this page on GitHub