Connect (OAuth)

Connect is Aepto's OAuth stack for first-party and approved clients. Endpoints live under https://app.aepto.com/connect/.

Endpoints

GET/POST https://app.aepto.com/connect/authorize — authorization
POST https://app.aepto.com/connect/token — authorization code and refresh
POST https://app.aepto.com/connect/revoke — revoke tokens

Discovery

https://app.aepto.com/.well-known/oauth-protected-resource
https://app.aepto.com/.well-known/oauth-authorization-server

First-party clients

Chrome extension - store listing and user steps: Docs -> Chrome; Connect notes: Chrome (Connect)
WordPress plugin - Docs -> WordPress; Connect notes: WordPress (Connect)
Claude connector - end-user install: Docs -> Claude; MCP / integrator notes: MCP

PKCE

Use S256 PKCE. Do not request offline_access unless it appears in server metadata; refresh tokens are still issued by https://app.aepto.com/connect/token according to current server behavior.

User revocation

Users revoke grants on Connected apps with Disconnect.

FAQ

What is Connect?

Connect is Aepto’s OAuth stack for Sign in with Aepto — used by Chrome, WordPress, Claude MCP, and approved custom clients under https://app.aepto.com/connect/.

Do end users paste API keys into Chrome or WordPress?

No. Those apps use Connect. End-user install steps: Chrome, WordPress, Claude.

Is PKCE required?

Yes — use S256 PKCE for public clients. See the PKCE notes on this page and the discovery metadata URLs above.

How do users disconnect an app?

Avatar menu → Connected apps → Disconnect, or disconnect from inside the Chrome/WordPress client.

Product FAQ hub: FAQ.