OAuth 2.0 Overview
Architecture, actors, privacy guarantees, and complete PKCE flow for connectable AI applications.
Zorveus implements the OAuth 2.0 Authorization Code Flow with PKCE (RFC 7636) to enable applications to connect to user AI wallets securely.
Interactive Flow Diagram
OAuth 2.0 Authorization Code with PKCE Flow
Step 1 of 6: Click next or select a step below to inspect the interaction.
User Browser
Developer App Backend
Zorveus Auth Server
Zorveus Consent UI
1
1. Generate code_verifier & challenge
App creates cryptographic code_verifier, hashes it with SHA-256 to create code_challenge, and sets state.
From: Developer App Backend➔To: User Browser
The Privacy Model
When a user authorizes your app via OAuth:
- Payer Privacy: You (the developer) receive a scoped inference token (
zrv_...). You never see the user's personal identity, email, organization membership, total wallet balance, or stored provider API keys. - Aggregate Analytics: Developer dashboards show aggregated token volumes and active connections across your user base.
- Per-User Control: The user retains full control to inspect usage logs, change spending caps, or revoke access at any time from their Zorveus dashboard.
OAuth Actors
- Client / App Developer: The application initiating authorization and exchanging tokens.
- Resource Owner / Payer: The user granting access and choosing which personal or team wallet funds the inference.
- Authorization Server: Zorveus OAuth endpoints (
/oauth/authorize,/oauth/token). - Resource Server: The Zorveus Inference Gateway (
https://api.zorveus.com/v1).
Was this page helpful?
Edit this page on GitHub