> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aireserve.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Initiate OAuth authorization (PKCE)

> Called by `aws login --profile …` (AWS CLI v2.32.0+) to start the OAuth authorization code + PKCE flow. A valid request returns HTTP 302, redirecting the browser to the AI Reserve portal approval page. After the user approves, the portal redirects the authorization `code` and `state` to `redirect_uri`: for **same-device** flows, `redirect_uri` is a `http://127.0.0.1:<port>/oauth/callback` the CLI listens on locally; for **cross-device** flows (`--remote`), `redirect_uri` is `https://api.aireserve.com/v1/sessions/confirmation`, which then 302s to the portal confirmation page where the user copies a Base64 string back into the CLI. No API key is required — the caller has not authenticated yet.



## OpenAPI

````yaml /api-reference/openapi.json get /v1/authorize
openapi: 3.0.3
info:
  title: AI Reserve Gateway API
  description: >-
    The AI Reserve API surface — OpenAI-compatible chat completions,
    Anthropic-compatible messages, Bedrock Converse, images, video, files,
    text-to-speech, realtime voice sessions, and provider-hidden GPU
    infrastructure — all behind one endpoint and one API key.
  version: 1.0.0
servers:
  - url: https://api.aireserve.com
security:
  - bearerAuth: []
tags:
  - name: Customers
    description: >-
      Per-end-customer usage, cost, and billable amounts for organizations that
      tag requests with their own customers.
  - name: GPU Infrastructure
    description: >-
      Provision and manage provider-hidden GPU instances. The recommended
      Instances API accepts workload requirements and an hourly price ceiling;
      AI Reserve handles provider placement internally. Every mutation is
      asynchronous and returns an operation to poll.
  - name: Customer keys
    description: >-
      Mint, list, and revoke API keys pinned to your own end customers (and
      their organizations), so spend splits per customer without per-request
      tagging.
  - name: AWS CLI login
    description: >-
      Browser-authorization endpoints consumed by `aws login --profile …` (AWS
      CLI v2.32.0+). All three routes are unauthenticated — the caller has no
      credential until `/v1/token` succeeds.
paths:
  /v1/authorize:
    get:
      tags:
        - AWS CLI login
      summary: Initiate OAuth authorization (PKCE)
      description: >-
        Called by `aws login --profile …` (AWS CLI v2.32.0+) to start the OAuth
        authorization code + PKCE flow. A valid request returns HTTP 302,
        redirecting the browser to the AI Reserve portal approval page. After
        the user approves, the portal redirects the authorization `code` and
        `state` to `redirect_uri`: for **same-device** flows, `redirect_uri` is
        a `http://127.0.0.1:<port>/oauth/callback` the CLI listens on locally;
        for **cross-device** flows (`--remote`), `redirect_uri` is
        `https://api.aireserve.com/v1/sessions/confirmation`, which then 302s to
        the portal confirmation page where the user copies a Base64 string back
        into the CLI. No API key is required — the caller has not authenticated
        yet.
      operationId: awsCliAuthorize
      parameters:
        - name: response_type
          in: query
          required: true
          description: Must be `code` (authorization code flow).
          schema:
            type: string
            enum:
              - code
        - name: client_id
          in: query
          required: true
          description: >-
            AWS CLI client identifier (same-device or cross-device ARN). Matched
            against the registered client list for the signin endpoint.
          schema:
            type: string
        - name: redirect_uri
          in: query
          required: true
          description: >-
            Callback URI. Same-device: `http://127.0.0.1:<port>/oauth/callback`.
            Cross-device: `https://api.aireserve.com/v1/sessions/confirmation`.
          schema:
            type: string
            format: uri
        - name: code_challenge
          in: query
          required: true
          description: 'PKCE code challenge: `BASE64URL(SHA-256(code_verifier))`.'
          schema:
            type: string
        - name: code_challenge_method
          in: query
          required: true
          description: Must be `SHA-256`.
          schema:
            type: string
            enum:
              - SHA-256
        - name: scope
          in: query
          required: true
          description: Must be `openid`.
          schema:
            type: string
            enum:
              - openid
        - name: state
          in: query
          required: true
          description: >-
            Opaque CSRF token generated by the CLI. Passed through unchanged to
            `redirect_uri`.
          schema:
            type: string
      responses:
        '302':
          description: >-
            Redirect to the AI Reserve portal approval page. After the user
            approves, the portal redirects `code` and `state` to `redirect_uri`.
          headers:
            Location:
              description: AI Reserve portal approval page URL.
              schema:
                type: string
                format: uri
        '400':
          description: >-
            Missing or invalid parameter (`response_type`, `client_id`,
            `redirect_uri`, `code_challenge`, `code_challenge_method`, `scope`,
            or `state`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AwsCliLoginError'
        '500':
          description: The authorization flow could not be started.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AwsCliLoginError'
      security: []
components:
  schemas:
    AwsCliLoginError:
      type: object
      required:
        - error
        - message
      properties:
        error:
          type: string
          description: Machine-readable Sign-In error code.
        message:
          type: string
          description: Human-readable explanation of the error.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        Your AI Reserve API key (aireserve_api_…) from the API Keys page in the
        portal (https://portal.aireserve.com/keys).

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.