Login with proxy.gonka.gg

A standard OAuth 2.0 Authorization Code flow with PKCE — the same shape as “Sign in with Google.” Users click your button, land on a proxy.gonka.gg consent screen, approve, and return with a one-time code you exchange server-side. We never share their password.

Client registration is manual today — email your app name and redirect URL(s) and we issue a client_id / client_secret with a fixed set of scopes.

Scopes

Scope	Grants
`profile`	Account ID, email, signup date
`usage`	Balance, total tokens, requests, spend
`api_key`	A new revocable API key minted for that connection. Existing keys are never revealed — we only store hashes.

1. Redirect the user

Generate a PKCE code_verifier and code_challenge (base64url of SHA-256(verifier)), then redirect to:

GET https://proxy.gonka.gg/oauth/authorize
    ?client_id=YOUR_CLIENT_ID
    &redirect_uri=https://yourapp.com/callback
    &state=RANDOM_CSRF_TOKEN
    &code_challenge=BASE64URL(SHA256(code_verifier))
    &code_challenge_method=S256

2. Exchange the code (server-side)

curl https://api.proxy.gonka.gg/api/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "<code from redirect>",
    "redirect_uri": "https://yourapp.com/callback",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "code_verifier": "<verifier from step 1>"
  }'

Response includes access_token (oat_…), refresh_token (ort_…), and on first connect api_key (sk-…) once. Store the key immediately.

Access tokens expire in 1 hour. Refresh with grant_type=refresh_token.

3. Read profile / usage

curl https://api.proxy.gonka.gg/api/oauth/userinfo \
  -H "Authorization: Bearer oat_..."

Endpoints

Method	Path	Auth	Description
GET	`/oauth/authorize`	Browser	Consent page
POST	`/api/oauth/token`	client_id + secret	Code or refresh
GET	`/api/oauth/userinfo`	Access token	Profile / usage
POST	`/api/oauth/revoke`	None	Revoke access or refresh token

Users disconnect apps from Settings. That revokes tokens and any minted key.