Connect OAuth

Torque Connect is v1 custody plumbing for execute callbacks in embedded wallet integrations. Your app starts OAuth; consent completion returns to your callback; you exchange the authorization code for a delegated JWT and call POST /execute/**. The long-term UX is embedded confirm in your shell — Connect is the shipping path for today. Business API keys provision wallets and read data — they do not sign user transactions.

v1 shipping note: Shipping today: consent completion returns to your app via a Connect callback and delegated JWT. Embedded confirm UI in your shell is on the roadmap.

Prerequisites

Business API key from developers.torque.fi (server only).
App URL registered in portal Settings → Execute callbacks (callback https://yourapp.com/torque/connect/callback).
End-user wallet provisioned via Wallets when building smart wallet flows.

OAuth Flow

Who	Action
Your server	POST /connect/authorize/session with redirect_uri, PKCE, and optional externalUserId
User	Confirms in your app (target); v1: consent completion via Connect callback
Your server	Callback at https://yourapp.com/torque/connect/callback receives ?code=…
Your server	POST /connect/token → delegated JWT
Your server	POST /execute/** with delegated JWT (never sk_live_… for user txs)

Test before launch: portal Settings → enable test execute callback (callback https://developers.torque.fi/connect/callback).

1. Authorize Session

authorize-session.sh

export TORQUE_KEY="sk_live_…"

curl -sS -X POST "https://app.torque.fi/api/v1/connect/authorize/session" \
  -H "Authorization: Bearer $TORQUE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "redirectUri": "https://yourapp.com/torque/connect/callback",
    "codeChallenge": "<pkce_challenge>",
    "codeChallengeMethod": "S256",
    "externalUserId": "your-user-id"
  }' | jq '.authorizeUrl'

Redirect the user to authorizeUrl. Use PKCE on the server; never expose sk_live_… to the browser.

2. Exchange Code

connect-token.sh

curl -sS -X POST "https://app.torque.fi/api/v1/connect/token" \
  -H "Authorization: Bearer $TORQUE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "code": "<from_callback>",
    "redirectUri": "https://yourapp.com/torque/connect/callback",
    "codeVerifier": "<pkce_verifier>"
  }' | jq '.accessToken, .expiresIn'

The returned accessToken is the delegated JWT for execute routes.

3. Execute

execute-transfer.sh

export DELEGATED_JWT="<accessToken from /connect/token>"

curl -sS -X POST "https://app.torque.fi/api/v1/execute/transfers/evm" \
  -H "Authorization: Bearer $DELEGATED_JWT" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{ ... prepared transfer body ... }'

Routes and idempotency: Actions, Execute Idempotency.

Integration Profiles

Torque supports multiple partner shapes. Profile B uses POST /connect/confirm → /connect/execute. Profiles C/D use the OAuth flow above. See Authentication and Actions: cash-out.

SDKs: torque-connect, torque-actions, @torquefi/react TorqueConnectButton.

Questions or corrections? hello@torque.fi