Developer documentation
OAuth authorization
OAuth lets a person authorize an IDE, coding agent, cowork tool, or third-party application without sharing an AbuseZero API key.
Authorization Code with PKCE
The client discovers AbuseZero’s Better Auth issuer, requests explicit Test or Live scopes, opens the AbuseZero consent flow, and exchanges the returned code with PKCE. Access tokens are short-lived; refresh tokens rotate.
Organization context
REST OAuth calls send AbuseZero-Organization with the selected organization ID. AbuseZero checks current membership on every request. Removing a member takes effect immediately.
Consent and added scopes
The consent screen names the requesting application, environment, and scopes. A client receives only the scopes the user approves. New scopes require consent again.
Revoke access
Disconnect an OAuth application in AbuseZero. Revocation is independent of API-key revocation. The client must authorize again before making another call.