OAuth client

An OAuth client lets your application call the VOL API as a VOL user — for example to read their saved collections or to run chats under their quota — without ever handling their password.

Planned flow (Authorization Code + PKCE)

Register a client in the VOL app under Developer → OAuth clients: name, logo, redirect URIs and requested scopes. You receive a client_id (and a client_secret for confidential clients).

Redirect the user to the authorization page:

https://<your-vol-host>/app/oauth/authorize
  ?client_id=…&redirect_uri=https://yourapp.com/callback
  &response_type=code&scope=chat:read graph:read
  &state=…&code_challenge=…&code_challenge_method=S256

The user signs in (Supabase: email, Google, SSO) and approves the requested scopes.

Exchange the code on your server:

curl -X POST https://<your-vol-host>/api/v1/oauth/token \
  -d grant_type=authorization_code -d code=… -d redirect_uri=… \
  -d client_id=… -d code_verifier=…

Response: { access_token, refresh_token, expires_in, token_type: "Bearer", scope }.

Call the API with Authorization: Bearer <access_token> — the SDK’s accessToken option works unchanged — and refresh with grant_type=refresh_token before it expires.

Planned scopes

Scope	Grants
`cases:read`	List cases
`chat:write`	Ask questions and stream answers
`search:read`	Semantic search
`graph:read`	Graph artifacts, nodes, neighbours, clusters
`profile:read`	`GET /v1/me`

Atoms with OAuth

<VolProvider accessToken={getToken}> will accept OAuth access tokens the same way it accepts Supabase sessions, so atoms will work for your users without changes.

Want early access? Tell us through the VOL app.