Build on CerebroChain with OAuth 2.1.

Two ways to authenticate

• OAuth 2.1 (per-user). Best for apps acting on behalf of a CerebroChain user. The user signs in and consents; your app receives a scoped, revocable Bearer token. Covered below.
• API key (machine-to-machine). For your own backend agents, issue a key in the console and send it as the X-API-Key header. Both paths bill the same tenant credit pool.

Register an OAuth app

Sign in to the console and open Settings → OAuth apps. Give the app a name, one or more redirect URIs (https, or http loopback for local development), and the scopes it may request. You'll receive a client_id and, for confidential apps, a client_secret shown once — store it securely; you can rotate it later but it is never shown again.

Programmatic clients may instead self-register via Dynamic Client Registration (RFC 7591).

Public vs confidential clients

• Public (token_endpoint_auth_method: none) — SPAs, mobile, and CLI tools that can't hold a secret. Security comes from PKCE (S256) and exact redirect-URI matching.
• Confidential (client_secret_basic or client_secret_post) — server-side apps. They additionally present a client_secret at the token endpoint. Only a hash of the secret is ever stored.

The authorization-code + PKCE flow

1. Generate a PKCE code_verifier and its code_challenge (S256, required).
2. Redirect the user to /api/oauth/authorize with client_id, redirect_uri, response_type=code, code_challenge, code_challenge_method=S256, your requested scope, and a state.
3. The user signs in on cerebrochain.com and approves the listed scopes. Your password and credentials never touch the app.
4. We redirect back to your redirect_uri with a single-use code (and your state).
5. Exchange the code at /api/oauth/token (grant_type=authorization_code) with the code_verifier — and, for confidential clients, the client_secret (HTTP Basic or in the body). You receive an access_token and a refresh_token.

Scopes

Request only what you need — every requested scope must be one the app is registered to hold (downscoping only). The consent screen lists each grant in plain English.

Calling the API

Send the access token as a Bearer credential to a priced /api/bot/* endpoint:

curl https://cerebrochain.com/api/bot/data/market/forex \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Each priced call deducts credits from the tenant's pool and requires the route's scope. A token missing the required scope gets 403 insufficient_scope; an invalid or expired token gets 401 with a WWW-Authenticate challenge. Top up credits in the console.

Token lifetime, refresh & revocation

• Access tokens expire after 1 hour. Use the refresh_token grant at /api/oauth/token to get a new pair; refresh tokens rotate on every use.
• Reuse detection. If a rotated (already-used) refresh token is replayed, the entire token family is revoked — so a stolen refresh token can't outlive detection.
• Revocation. Revoke any token at /api/oauth/revoke (RFC 7009). Tenants can also review and revoke connected apps from Settings → OAuth apps.

Endpoints & discovery

Issuer: https://cerebrochain.com. Metadata is published per RFC 8414 / RFC 9728:

Support

Questions or a bug? Email [email protected], call 775-719-9177, or use the contact form. Connecting an AI assistant instead? See the MCP connector guide.