Let third-party apps request OpenDunes API access on behalf of your users.
Not yet available. OAuth PKCE is not yet available. This page describes the intended flow so you can plan your integration ahead of time.
OAuth PKCE (Proof Key for Code Exchange) will let you build applications that request access to a user's OpenDunes account without ever handling their credentials. The user grants permission through a consent screen; your app receives a scoped API key it can use on their behalf.
Use PKCE when you are building:
For server-to-server integrations you control entirely, use a regular API key instead.
Your app generates a cryptographically random code_verifier (43–128 characters), then derives a code_challenge by SHA-256 hashing it and base64url-encoding the result.
Send the user to:
The user sees a consent screen listing the permissions your app is requesting. If they approve, they are redirected back to your redirect_uri with a short-lived code.
POST to the token endpoint with the code and your original verifier:
On success, the response includes an api_key scoped to the user's account:
Pass the API key in Authorization: Bearer headers on any OpenDunes API request. It is tied to the user's balance and subject to their rate limits.
| Scope | Access |
|---|---|
api | Make inference requests, charged to the user's balance |
api:read | Read-only access to models, usage, and balance — no inference |
Additional scopes (e.g. keys:manage) will be added as the platform grows.
You will need to register your application to receive a client_id. Registration will be available in your dashboard under Integrations. Provide a name, description, and one or more allowed redirect_uri values. No client secret is required — PKCE is the security mechanism.
state parameter on the redirect to prevent CSRF.code_verifier must be kept in memory only — never log or persist it.