Visit REZICS

Developers

Apps never get more access than you do.

REZICS records sign-in, acting identity, resource permissions, and app authorization separately. Tokens for apps and AI agents can only narrow access within those limits.

Four layers

Each layer narrows access

Account, identity, installation and consent, and token scopes are recorded separately. Each inner layer stays within the outer one. An app receives only the narrowest layer.

Four sheets of paper are stacked from largest to smallest. The outer sheet is deep blue-gray, and the smallest light blue sheet sits on top.

By layer

What each layer controls

  • Account

    The account service confirms who you are. Signing in alone does not grant access to any resource.

  • Identity

    You act as yourself or an organization. The server checks that relationship and its resource permissions.

  • Installation and consent

    Installation and consent are separate limits. Registering an app does not grant access to resources.

  • Token scopes

    A token carries only the scopes you approved, such as library:write. Every operation still checks which identity is acting.

Authorization

Authorization code with PKCE

GET /api/auth/oauth2/authorize
  ?response_type=code
  &client_id=…
  &redirect_uri=https://a.example/
  &scope=work:read%20library:write
  &code_challenge=…
  &code_challenge_method=S256
  &state=…
The authorization request goes to the REZICS account service. The redirect URL must exactly match the one registered.

Consent

What the consent screen shows

REZICS products do not show a consent screen. They appear on the account page as product sessions.

  • name · uri

    The app name and website

  • scopes[].description

    Each permission explained in your language, with English as a fallback

  • unverified

    A clear notice when an app is unverified

  • redirectHost

    The domain you will return to after authorization

  • policy · terms

    The app’s privacy policy and terms of service

Revoke

Revoke access at any time

  • Review

    The account’s Connected apps page lists what each app can do, when you authorized it, and when it was last used.

  • Confirm

    Your identity is verified again before access is removed.

  • Invalidate

    After removal, the app’s tokens can no longer be used, including tokens for renewal.

  • Disable

    Apps disabled by REZICS are marked. You can still remove the authorization they retain.

Developers

More pages

Build your tools on one API.

Use your own code to read and write works, library entries, and community data. Every operation follows REZICS identity and authorization rules.

Visit REZICS

Products

Modules

Language