Exchange short-lived authorization codes and PKCE verifiers for scoped inference tokens.

Token Exchange

POST/oauth/token

OAuth Bearer Token

Once the user approves your app, Zorveus redirects to your redirect_uri with ?code=...&state=.... Your backend makes a server-to-server POST request to exchange the code for an inference token.

Token Request Parameters

Parameter	Type	Required	Description
`grant_type`	string	Yes	Must be `authorization_code`.
`client_id`	string	Yes	Your application Client ID.
`client_secret`	string	Yes	Your confidential Client Secret.
`code`	string	Yes	Single-use authorization code from redirect callback.
`code_verifier`	string	Yes	Plaintext string used to generate `code_challenge`.
`redirect_uri`	string	Yes	Exact URI sent in initial authorization request.

Code Example

const response = await fetch("https://api.zorveus.com/oauth/token", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    grant_type: "authorization_code",
    client_id: "zrv_client_your_client_id",
    client_secret: "zrv_client_secret_your_client_secret",
    code: authCodeFromRedirect,
    code_verifier: codeVerifier,
    redirect_uri: "https://myapp.com/callback",
  }),
});

const tokenData = await response.json();
console.log("Scoped Inference Token:", tokenData.access_token);

Was this page helpful?

Edit this page on GitHub

Token Exchange

Token Exchange

Token Request Parameters

Code Example

On this page