OAuth authorization
OAuth lets a person authorize an IDE, coding agent, cowork tool, or third-party application without sharing a Veltor API key.
Authorization Code with PKCE
The client discovers Veltor’s Better Auth issuer, requests explicit Test or Live scopes, opens the Veltor consent flow, and exchanges the returned code with PKCE. Access tokens are short-lived; refresh tokens rotate.
Organization context
REST OAuth calls send Veltor-Organization with the selected organization ID. Veltor checks current membership on every request. Removing a member takes effect immediately.
Consent and added scopes
The consent screen names the requesting application, environment, and scopes. A client receives only the scopes the user approves. New scopes require consent again.
Revoke access
Disconnect an OAuth application in Veltor. Revocation is independent of API-key revocation. The client must authorize again before making another call.