OAuth 2.0

​

Endpoints

GET https://api.cruq.ai/.well-known/oauth-authorization-server

​

Flow

1. Register a client (once). Public clients use PKCE and no secret:
   curl -X POST https://api.cruq.ai/oauth/register \
     -H "Content-Type: application/json" \
     -d '{"client_name":"My Agent","redirect_uris":["https://myagent.example/callback"],"token_endpoint_auth_method":"none"}'
   
   The response contains a client_id (and a client_secret for confidential clients).
2. Send the user to authorize. Generate a PKCE code_verifier / code_challenge, then redirect the user to:
   https://app.cruq.ai/oauth/authorize?response_type=code
     &client_id=<client_id>
     &redirect_uri=<your redirect_uri>
     &code_challenge=<S256 challenge>&code_challenge_method=S256
     &state=<random>
   
   The user signs in (if needed), sees a consent screen for their workspace, and approves. Cruq AI redirects back to your redirect_uri with ?code=...&state=....
3. Exchange the code for tokens:
   curl -X POST https://api.cruq.ai/oauth/token \
     -d grant_type=authorization_code \
     -d client_id=<client_id> \
     -d redirect_uri=<your redirect_uri> \
     -d code=<code> \
     -d code_verifier=<verifier>
   
   Returns access_token (cruq_at_...), refresh_token, expires_in, and scope.
4. Call the API with the access token, exactly like an API key:
   curl https://api.cruq.ai/v1/agents -H "Authorization: Bearer cruq_at_..."
   
   Access tokens also work against the MCP server. Refresh with grant_type=refresh_token when the access token expires.

​

Scopes