Partner OAuth Integration
Beta. OAuth mode is rolling out gradually. Contact us to get your app registered.
If you have integrated ofox into your own product, users can sign in through an OAuth button without ever leaving your app. New users who register this way are automatically attributed to your partner channel — exactly as if they had signed up through your referral link.
How to get started
- Contact us to register your application.
- We create the OAuth application for you and bind it to your partner channel.
- Add the OAuth button to your product using the standard OAuth 2.1 flow.
There is nothing to configure on your side beyond the standard OAuth flow — no extra parameters, no URL format, no SDK. The channel binding is configured server-side on our end.
What gets attributed
New registrations only. When a user who has no ofox account clicks your OAuth button, they are taken to the ofox sign-in page, switch to sign-up, and complete registration. At that moment the binding to your channel is created. From then on, their top-ups and usage flow through the normal partner commission settlement.
Users who already have an ofox account keep their existing attribution. Authorizing your app does not change it — not even if they have never been attributed to any partner. This applies both to users already bound to another partner and to users with no binding at all.
This is deliberate: a referral binding is permanent and exclusive for the lifetime of the account. Allowing re-binding would let one partner take over users another partner brought in.
First-call scope
The access token you receive right after sign-up may not include llm.invoke yet.
llm.invoke is only granted to users whose email address is verified. Whether that is already true at the moment of sign-up depends on how the user registered:
| Sign-up method | Email verified on completion | llm.invoke in the first token |
|---|---|---|
| Passwordless link | Yes — clicking the link is the verification | Granted |
| Email + password | Not yet | Dropped until verified |
When a scope is dropped, the token request still succeeds — the scope field in the response lists what was actually granted, per RFC 6749 §3.3. Read that field instead of assuming you got everything you asked for. Calling the LLM API without llm.invoke returns 403 insufficient_scope.
Once the user verifies their email, request a new token (or refresh) and llm.invoke will be included.
Commission
Attributed users are settled under the standard tiered partner commission (up to 9%), based on actual API usage. Payouts start at $50 and are settled monthly. See the Partner page for current terms.