Build an app with RocketVerifier Connect
Connect is OAuth 2.0 for RocketVerifier. Your users click a button, approve your app, and you call the API on their account. They never paste an API key, and the verifications run on their credits.
How it works
1. Connect button
The user clicks Connect RocketVerifier in your product. You redirect them to the authorize URL with the scopes you need.
2. Consent screen
They sign in at app.rocketverifier.com, pick their personal account or an organization, optionally set a monthly credit cap, and approve.
3. Call the API
You exchange the code for tokens and call api.rocketverifier.com with Authorization: Bearer rv_at_..., exactly like an API key.
OAuth or API key?
Use an API key when the account is yours. Use OAuth when the account belongs to someone else.
| API key | OAuth (Connect) | |
|---|---|---|
| Whose account | Yours | Each of your users (personal or organization) |
| Who pays for credits | You | The connecting user or their organization |
| How the user grants access | Copies a key from the dashboard into your app | Clicks a button and approves a consent screen |
| Access limits | Scopes chosen when the key is created | Scopes the user approved, plus an optional monthly credit cap |
| Lifetime | Until you revoke it | 1 hour access token, 90 day rotating refresh token |
| User can disconnect | Only by deleting the key | Settings > Connected apps, one click |
| Sandbox | rv_test_ keys | Always live; test against your own account |
| Good for | Your backend, scripts, internal tools | SaaS products, plugins, AI agents, MCP clients |
Both credentials use the same header and the same endpoints. See Authentication for API keys.
Who pays
Every call made with an OAuth token is billed to the account that connected. Developers pay nothing to build or run an app.
- A personal connection uses the user's own credits and rate limit.
- An organization connection uses the organization's credit pool and rate limit. It stops working if the person who approved it is no longer an owner or admin of that organization.
- Users can set a monthly credit cap for your app on the consent screen. Past the cap, and when the balance runs out, calls return
402.
What you get
- Standard OAuth 2.0 authorization code flow with PKCE (
S256), refresh token rotation, revocation (RFC 7009), introspection (RFC 7662) and server metadata (RFC 8414). - Confidential clients (server apps with a secret) and public clients (SPA, mobile, CLI, MCP) with PKCE.
- Self-serve app registration in Dashboard > Developer apps. Your app works right away and shows an Unverified badge until it passes review.
- A signed
grant.revokedwebhook when a user disconnects, so you can clean up. - Official Node.js and Python SDK helpers that handle PKCE, the code exchange and automatic refresh.
The Connect RocketVerifier button
Use the official button so users recognize it. Both versions are plain SVG files you can host yourself.
<a href="/connect/rocketverifier">
<img src="https://docs.rocketverifier.com/brand/connect-rocketverifier-light.svg"
alt="Connect RocketVerifier" height="44">
</a>Point the link at a route on your server that builds the authorize URL and stores state and the PKCE verifier. Do not hard-code the authorize URL in the page.
Build it with your AI coding assistant
Paste one URL
Paste https://docs.rocketverifier.com/build-an-integration.md into Claude Code, Cursor, Copilot or any AI coding assistant and ask it to add Connect RocketVerifier to your app. The file is a single self-contained spec: endpoints, scopes, the PKCE flow, error handling, button assets and recommended UI copy.
Connecting AI assistants
Claude, ChatGPT and other MCP clients use the same OAuth flow to connect to https://api.rocketverifier.com/mcp without an API key. Clients register themselves, so there is nothing to set up in the dashboard. See MCP connector.