Developer apps

Sign in with app.nz

Give your product app.nz accounts without building identity infrastructure. Register the app and its exact callback URLs in the Developer Apps console, choose the smallest set of scopes it needs, then use Authorization Code with PKCE. Browser, hosted-site, mobile, desktop, and CLI clients are public clients and never receive a secret; confidential server apps exchange the code on their backend.

basehttps://app.nz
GET/authorizeStart authorization with response_type=code and a PKCE S256 challengepublic
POST/tokenExchange a one-use authorization code and PKCE verifierpublic
GET/userinfoRead the profile granted to the current access tokenAPI key
POST/introspectLet a confidential app validate an app-scoped tokenpublic
POST/revokeRevoke the current access token during sign-outpublic
GET/.well-known/oauth-authorization-serverOAuth authorization-server discovery metadatapublic
Setup checklist
Redirect URL*exact URLRegister every production and local callback exactly. Hosted sites normally use https://<slug>.app.nz/auth/callback.
profile*scopeStable account id, email, and handle for the signed-in person.
apiscopeCall app.nz REST APIs and authenticated MCP tools as that person.
credits:readscopeRead the person’s credit balance and this app’s ledger entries.
credits:spendscopeCharge the person’s app.nz balance for work your app performs.
models:chatscopeRun chat completions at POST /v1/chat/completions on the model(s) listed in the authorize request’s models parameter (e.g. models=gpt-5.5), billed to the person’s credits. Pinned: any other model, fallback, or endpoint is refused.
keys:manageserver scopeCreate and revoke API keys owned by the app; confidential server apps only.
Browser and hosted-site quickstart
import { createAuthClient } from 'https://app.nz/appnz-auth.js';

const auth = createAuthClient({
  clientId: 'YOUR_CLIENT_ID',
  redirectUri: window.location.origin + '/auth/callback',
  scopes: ['profile', 'api'],
});

// Sign-in button
await auth.signIn({ returnTo: '/dashboard' });

// On /auth/callback
const result = await auth.handleRedirect();
if (result) window.location.replace(result.returnTo);

// Restore the user and call app.nz with the saved access token
const user = await auth.getUser();
const response = await auth.fetch('/api/me');