codai Authorization API
Authorization Code + PKCE and Device Authorization (RFC 8628) grants.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/codai-ro:codai-ro-authorization-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Codai Ro Authorization API
version: '1'
description: 'Operations tagged Authorization across 2 of this provider''s published API definitions: codai-ro-auth-openapi.json, codai-ro-auth-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://auth.codai.ro
description: Production
security: []
tags:
- name: Authorization
description: Authorization Code + PKCE and Device Authorization (RFC 8628) grants.
paths:
/auth:
get:
operationId: authorize
tags:
- Authorization
summary: Authorization endpoint (code + PKCE)
description: 'Starts the Authorization Code flow. Redirect the user''s browser here; codai renders its
own login / sign-up / consent pages on this origin and finally redirects to
`redirect_uri` with `code` and `state` (or `error` + `error_description`). PKCE is
mandatory (`code_challenge_method=S256`). First-party clients skip the consent screen.
Requesting `urn:codai:acr:passkey` or `urn:codai:acr:mfa` forces a fresh login unless the
session already holds that acr and is younger than 10 minutes. Invalid `client_id` /
`redirect_uri` render an HTML error page instead of redirecting.'
parameters:
- name: response_type
in: query
required: true
description: Must be `code`.
schema:
type: string
enum:
- code
- name: client_id
in: query
required: true
description: Registered client identifier.
schema:
type: string
examples:
- metu
- codai-console
- name: redirect_uri
in: query
required: true
description: One of the client's registered redirect URIs (exact match).
schema:
type: string
format: uri
- name: scope
in: query
required: true
description: Space-separated scopes; must include `openid`.
schema:
type: string
examples:
- openid email profile inference keys:manage
- name: state
in: query
required: false
description: Opaque CSRF value echoed back on the redirect. Strongly recommended.
schema:
type: string
- name: code_challenge
in: query
required: true
description: BASE64URL(SHA-256(code_verifier)) — PKCE is required for every client.
schema:
type: string
- name: code_challenge_method
in: query
required: true
description: Only `S256` is supported.
schema:
type: string
enum:
- S256
- name: nonce
in: query
required: false
description: Replay protection echoed into the ID token.
schema:
type: string
- name: prompt
in: query
required: false
description: Standard OIDC prompt values (`login`, `consent`, `none`, `select_account`).
schema:
type: string
- name: acr_values
in: query
required: false
description: Requested authentication context; passkey/mfa trigger step-up.
schema:
type: string
examples:
- urn:codai:acr:mfa
- name: resource
in: query
required: false
description: RFC 8707 resource indicator. `https://ai.codai.ro/mcp` yields a JWT access token with the `mcp` scope.
schema:
type: string
format: uri
- name: mode
in: query
required: false
description: codai extension — `signup` opens the sign-up form directly.
schema:
type: string
enum:
- signup
- name: ref
in: query
required: false
description: codai extension — referral code (`codai.ro/r/<username>`, 3–20 chars `[A-Za-z0-9_]`) pre-filled on sign-up.
schema:
type: string
pattern: ^[A-Za-z0-9_]{3,20}$
- name: lang
in: query
required: false
description: UI language of the login pages. Defaults from the `NEXT_LOCALE` cookie, then `Accept-Language`.
schema:
type: string
enum:
- ro
- en
responses:
'303':
description: Redirect to the codai login/consent UI, or back to `redirect_uri` with `code`+`state` (or `error`).
headers:
Location:
schema:
type: string
format: uri
'400':
description: Unrecoverable request error (unknown client, bad `redirect_uri`) rendered as an HTML page.
content:
text/html:
schema:
type: string
servers:
- url: https://auth.codai.ro
description: Production
/device/auth:
post:
operationId: deviceAuthorization
tags:
- Authorization
summary: Device authorization request (RFC 8628)
description: 'For input-constrained clients such as the `codai-cli`. Returns a `device_code`, a
`user_code` (format `****-****`, base-20 charset) and the `verification_uri` the user
opens in a browser. Then poll `POST /token` with
`grant_type=urn:ietf:params:oauth:grant-type:device_code` at `interval` seconds until
the user approves (`authorization_pending` / `slow_down` / `access_denied` /
`expired_token` in between). Only clients registered with the device_code grant may call it.'
requestBody:
required: true
content:
application/x-www-form-urlencoded:
schema:
type: object
required:
- client_id
properties:
client_id:
type: string
examples:
- codai-cli
scope:
type: string
description: Space-separated scopes.
examples:
- openid email inference offline_access
resource:
type: string
format: uri
description: Optional RFC 8707 resource indicator.
responses:
'200':
description: Device authorization issued.
content:
application/json:
schema:
$ref: '#/components/schemas/DeviceAuthorizationResponse'
'400':
$ref: '#/components/responses/OAuthBadRequest'
'401':
$ref: '#/components/responses/OAuthInvalidClient'
servers:
- url: https://auth.codai.ro
description: Production
components:
responses:
OAuthInvalidClient:
description: Client authentication failed (`invalid_client`).
content:
application/json:
schema:
$ref: '#/components/schemas/OAuthError'
OAuthBadRequest:
description: Malformed request, bad grant, invalid code_verifier, unsupported grant type, or device flow pending (`authorization_pending`, `slow_down`, `expired_token`, `access_denied`).
content:
application/json:
schema:
$ref: '#/components/schemas/OAuthError'
schemas:
OAuthError:
type: object
title: OAuth error
description: RFC 6749 §5.2 error envelope, also used by the codai extensions on this host.
required:
- error
properties:
error:
type: string
description: Machine-readable code.
examples:
- invalid_request
- invalid_client
- invalid_grant
- invalid_token
- insufficient_scope
- authorization_pending
- slow_down
- rate_limited
error_description:
type: string
description: Human-readable detail.
DeviceAuthorizationResponse:
type: object
title: Device authorization response
required:
- device_code
- user_code
- verification_uri
- verification_uri_complete
- expires_in
properties:
device_code:
type: string
user_code:
type: string
description: Shown to the user; format `****-****`.
examples:
- BCDF-GHJK
verification_uri:
type: string
format: uri
examples:
- https://auth.codai.ro/device
verification_uri_complete:
type: string
format: uri
description: '`verification_uri` with the `user_code` pre-filled.'
expires_in:
type: integer
description: Seconds until the device code expires.
interval:
type: integer
description: Minimum seconds between `/token` polls.
examples:
- 5
securitySchemes:
oauth2:
type: oauth2
description: codai OpenID Connect provider. PKCE `S256` required on the authorization code flow.
flows:
authorizationCode:
authorizationUrl: https://auth.codai.ro/auth
tokenUrl: https://auth.codai.ro/token
refreshUrl: https://auth.codai.ro/token
scopes:
openid: Verify your codai identity
profile: See your name and profile picture
email: See your email address
inference: Run AI inference through your codai account
keys:manage: Create and manage codai API keys on your behalf
usage:read: Read your codai usage statistics
subscriptions:read: Read your codai subscription plan
mcp: Use codai tools and memory from an MCP client
offline_access: Stay signed in on this device
deviceCode:
deviceAuthorizationUrl: https://auth.codai.ro/device/auth
tokenUrl: https://auth.codai.ro/token
scopes:
openid: Verify your codai identity
profile: See your name and profile picture
email: See your email address
inference: Run AI inference through your codai account
keys:manage: Create and manage codai API keys on your behalf
usage:read: Read your codai usage statistics
subscriptions:read: Read your codai subscription plan
mcp: Use codai tools and memory from an MCP client
offline_access: Stay signed in on this device
bearerAuth:
type: http
scheme: bearer
description: OAuth access token issued by `/token` (used by `/me` and `/connect/key`).
clientSecretBasic:
type: http
scheme: basic
description: '`client_secret_basic` client authentication. `client_secret_post` and `private_key_jwt` go in the form body instead; public clients send only `client_id`.'
x-refined-from:
- codai-ro-auth-openapi.json
- codai-ro-auth-openapi.yml