OAuth 2.1
Use authorization code with PKCE and Connect protected resource discovery.
OAuth clients use authorization code with PKCE. The authorization server is
https://auth.torqee.app. Discover its OAuth metadata at
https://auth.torqee.app/.well-known/oauth-authorization-server.
| Endpoint | URL |
|---|---|
| Authorization | https://auth.torqee.app/oauth/authorize |
| Token | https://auth.torqee.app/oauth/token |
Resource indicator
When requesting authorization, include the RFC 8707 resource parameter:
resource=https://connect.torqee.appConnect validates the access token audience against that resource. Tokens issued for another audience are rejected.
Protected resource discovery
When a request has no valid Bearer credential, Connect returns a 401 response
with a WWW-Authenticate header pointing at protected resource metadata:
WWW-Authenticate: Bearer resource_metadata="https://connect.torqee.app/.well-known/oauth-protected-resource"Fetch the metadata endpoint to discover the resource, authorization server, and supported scopes:
{
"resource": "https://connect.torqee.app",
"authorization_servers": ["https://auth.torqee.app"],
"scopes_supported": [
"torqee:sessions:read",
"torqee:transcripts:read",
"torqee:audio:read",
"torqee:boards:read",
"torqee:webhooks:read",
"torqee:webhooks:write"
]
}Scopes
Request only the scopes your integration needs:
| Scope | Allows |
|---|---|
torqee:sessions:read | List sessions and read session metadata. |
torqee:transcripts:read | Search transcripts and read transcript segments. |
torqee:audio:read | Get temporary session audio download URLs. |
torqee:boards:read | List and read AI board contents. |
torqee:webhooks:read | Read webhook endpoints and delivery history. |
torqee:webhooks:write | Manage, test, and replay webhooks. |
Creating a webhook for a session.* event also requires
torqee:sessions:read. Fetching a transcript after a completion event requires
torqee:transcripts:read. Existing grants do not gain webhook scopes
automatically; audio access also requires a new grant with explicit user consent.
If a token is valid but does not include the required scope, Connect returns
403 { "error": "insufficient_scope" }.