Skip to navigation
Runtype APIEnd User Integrations

Begin end-user OAuth connection

Verifies the end user’s identity proof, projects a durable end-user identity, and returns the third-party authorize URL with a single-use state. Builder-authenticated; the end-user identity comes only from the verified proof.

Authentication

AuthorizationBearer
API key or Clerk session token

Path parameters

providerstringRequired

OAuth connector provider slug, e.g. github.

Request

This endpoint expects an object.
identityProofstringRequired>=1 character

The end user’s customer-native Identity-Exchange proof (a JWT). Verified server-side against the builder’s configured identity integrations; the verified subject becomes the end-user identity. Never a body-asserted id.

redirectAfterstringOptionalformat: "uri"

Where to redirect the end user after the OAuth callback completes. Must be a safe http(s)/app-scheme URL (open-redirect schemes are rejected).

Response

Authorize URL issued
authorizeUrlstring

Redirect the end user here to authorize the third-party account.

endUserIdstring

The durable end-user id (eu_*) the token will scope to.

statestring

Opaque single-use CSRF token (bound in KV).

Errors

400
Bad Request Error
401
Unauthorized Error
403
Forbidden Error
404
Not Found Error
501
Not Implemented Error