Hypery

OAuth provider for your AI product

Let other apps sign in with your product

Become an OAuth 2.0 provider. Hand third-party apps your product’s identity and scoped, revocable access to call the gateway on a user’s behalf.

Start buildingRead the docs

How it works

Authorize, exchange, act

Authorize with consent

Third-party apps send users to your authorize endpoint. A consent screen shows exactly which scopes they’re granting before anything is issued.

Exchange the code

The app trades the authorization code for tokens using PKCE, so a code_verifier — not a shared secret in the browser — proves the request is legitimate.

Call on the user’s behalf

With the returned token the app calls the gateway scoped to what the user allowed — ai:chat, ai:models, billing:read — and you can revoke it anytime.

Token exchange

Trade a code for scoped access

After the consent screen, the third-party app swaps its authorization code and PKCE verifier for an access token — then calls the gateway with only the scopes the user granted.

  • Authorize, token, and revoke endpoints
  • PKCE and refresh tokens for public clients
  • Hosted consent screen with per-scope disclosure
  • Seven scopes from read to ai:chat to billing:read
OAuth 2.0 and PKCE
// callback.ts — exchange the code for tokens
const res = await fetch("https://hypery.ai/api/oauth/token", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    grant_type: "authorization_code",
    code,
    code_verifier: verifier,
    client_id,
    redirect_uri,
  }),
})
 
const { access_token } = await res.json()

FAQ

Questions

Which OAuth flows are supported?
The authorization code flow with PKCE and refresh tokens, plus authorize, token, and revoke endpoints and a hosted consent screen. It’s standard OAuth 2.0, so existing clients just work.
What scopes can other apps request?
Seven scopes: read, write, ai:chat, ai:completions, ai:models, ai:images, and billing:read. The consent screen shows each requested scope so users grant exactly what they intend.
Can users revoke access later?
Yes. A revoke endpoint invalidates a token, and refresh tokens keep long-lived sessions alive until revoked, so users and admins stay in control of third-party access.
Do I need PKCE?
For public clients, yes — the token exchange takes a code_verifier that pairs with the challenge sent at authorize time, so intercepted codes can’t be redeemed by an attacker.

OAuth provider for your AI product

Own the identity layer

Issue scoped OAuth access to the apps building on you, with consent and revocation baked in — no OAuth server to maintain yourself.

Start buildingRead the docs