Use this page when you need delegated authorization against the ZAST.AI identity layer or when your frontend must bootstrap Clerk before calling protected APIs.

Preparation

• Contact support@zast.ai to provision your application and register the expected redirect_uri.
• Confirm your client receives the required client_id and client_secret before wiring the authorization flow.

OAuth Endpoints

• Authorization URL: https://clerk.zast.ai/oauth/authorize
• Token URL: https://clerk.zast.ai/oauth/token
• User Info URL: https://clerk.zast.ai/oauth/userinfo

Authorization Code Flow

1. Redirect the user to the authorization URL with response_type=code, client_id, redirect_uri, scope, and state.
2. Receive the authorization code on your callback URL.
3. Exchange the code for tokens by posting application/x-www-form-urlencoded data to the token endpoint.
4. Refresh access when needed through the same token endpoint with grant_type=refresh_token.
5. Send the resulting bearer token to the APIs that require authenticated context.

Frontend Bootstrap Endpoint

• Endpoint: GET /biz/api/v1/auth/clerk/publishable-key
• Purpose: return the Clerk publishable key used to initialize the frontend SDK.
• Typical sequence:
  1. Fetch the publishable key from the Business API.
  2. Initialize Clerk in the frontend.
  3. Continue the authorization flow or authenticated API calls with the resulting session context.

Example Request

curl -X GET 'https://zast.ai/biz/api/v1/auth/clerk/publishable-key'

Example Response

{
  "publishableKey": "pk_live_xxx"
}