OAuth 2.1

Use authorization code with PKCE and Connect protected resource discovery.

OAuth clients use authorization code with PKCE. The authorization server is https://auth.torqee.app. Discover its OAuth metadata at https://auth.torqee.app/.well-known/oauth-authorization-server.

Endpoint	URL
Authorization	`https://auth.torqee.app/oauth/authorize`
Token	`https://auth.torqee.app/oauth/token`

Resource indicator

When requesting authorization, include the RFC 8707 resource parameter:

resource=https://connect.torqee.app

Connect validates the access token audience against that resource. Tokens issued for another audience are rejected.

Protected resource discovery

When a request has no valid Bearer credential, Connect returns a 401 response with a WWW-Authenticate header pointing at protected resource metadata:

WWW-Authenticate: Bearer resource_metadata="https://connect.torqee.app/.well-known/oauth-protected-resource"

Fetch the metadata endpoint to discover the resource, authorization server, and supported scopes:

{
  "resource": "https://connect.torqee.app",
  "authorization_servers": ["https://auth.torqee.app"],
  "scopes_supported": [
    "torqee:sessions:read",
    "torqee:transcripts:read",
    "torqee:audio:read",
    "torqee:boards:read",
    "torqee:webhooks:read",
    "torqee:webhooks:write"
  ]
}

Scopes

Request only the scopes your integration needs:

Scope	Allows
`torqee:sessions:read`	List sessions and read session metadata.
`torqee:transcripts:read`	Search transcripts and read transcript segments.
`torqee:audio:read`	Get temporary session audio download URLs.
`torqee:boards:read`	List and read AI board contents.
`torqee:webhooks:read`	Read webhook endpoints and delivery history.
`torqee:webhooks:write`	Manage, test, and replay webhooks.

Creating a webhook for a session.* event also requires torqee:sessions:read. Fetching a transcript after a completion event requires torqee:transcripts:read. Existing grants do not gain webhook scopes automatically; audio access also requires a new grant with explicit user consent.

If a token is valid but does not include the required scope, Connect returns 403 { "error": "insufficient_scope" }.