---
title: OAuth 2.1
description: Use authorization code with PKCE and Connect protected resource discovery.
---

OAuth clients use authorization code with PKCE. The authorization server is
`https://auth.torqee.app`. Discover its OAuth metadata at
`https://auth.torqee.app/.well-known/oauth-authorization-server`.

| Endpoint      | URL                                       |
| ------------- | ----------------------------------------- |
| Authorization | `https://auth.torqee.app/oauth/authorize` |
| Token         | `https://auth.torqee.app/oauth/token`     |

## Resource indicator

When requesting authorization, include the RFC 8707 `resource` parameter:

```text
resource=https://connect.torqee.app
```

Connect validates the access token audience against that resource. Tokens
issued for another audience are rejected.

## Protected resource discovery

When a request has no valid Bearer credential, Connect returns a 401 response
with a `WWW-Authenticate` header pointing at protected resource metadata:

```http
WWW-Authenticate: Bearer resource_metadata="https://connect.torqee.app/.well-known/oauth-protected-resource"
```

Fetch the metadata endpoint to discover the resource, authorization server, and
supported scopes:

```json
{
  "resource": "https://connect.torqee.app",
  "authorization_servers": ["https://auth.torqee.app"],
  "scopes_supported": [
    "torqee:sessions:read",
    "torqee:transcripts:read",
    "torqee:audio:read",
    "torqee:boards:read",
    "torqee:webhooks:read",
    "torqee:webhooks:write"
  ]
}
```

## Scopes

Request only the scopes your integration needs:

| Scope                     | Allows                                           |
| ------------------------- | ------------------------------------------------ |
| `torqee:sessions:read`    | List sessions and read session metadata.         |
| `torqee:transcripts:read` | Search transcripts and read transcript segments. |
| `torqee:audio:read`       | Get temporary session audio download URLs.       |
| `torqee:boards:read`      | List and read AI board contents.                 |
| `torqee:webhooks:read`    | Read webhook endpoints and delivery history.     |
| `torqee:webhooks:write`   | Manage, test, and replay webhooks.               |

Creating a webhook for a `session.*` event also requires
`torqee:sessions:read`. Fetching a transcript after a completion event requires
`torqee:transcripts:read`. Existing grants do not gain webhook scopes
automatically; audio access also requires a new grant with explicit user consent.

If a token is valid but does not include the required scope, Connect returns
`403 { "error": "insufficient_scope" }`.