Add "Login with Innovorus"
to any app or tool

How "Login with Innovorus" works

A standard OAuth 2.0 Authorization Code flow with PKCE — safe for native and desktop apps without a server-side secret.

1. 1

   User opens your app / EXE

   Your software shows a "Login with Innovorus" button. No password goes to your app — auth stays on Innovorus.

2. 2

   Browser opens Innovorus

   Your app opens the system browser (or a webview) pointed at innovorus.com/oauth/authorize with a PKCE code challenge.

3. 3

   User logs in and approves

   Innovorus shows a consent screen listing what the app will access. The user clicks Allow.

4. 4

   Redirect back with an auth code

   Innovorus redirects to your registered redirect URI (can be localhost or a custom scheme like myapp://).

5. 5

   Exchange code for tokens

   Your app exchanges the code + PKCE verifier for an access token (1 h) and refresh token (30 d) — no client secret needed.

6. 6

   Check entitlements

   Call GET /api/v1/entitlements to get the user's plan, status, credits, and feature flags. Gate features accordingly.

JavaScript / TypeScript quick-start

Works in browsers, Electron apps, and any JS runtime with a crypto global (Node 18+, Deno, Bun).

import { InnovorusClient } from "@innovorus/sdk";

const client = new InnovorusClient({
  baseUrl: "https://www.innovorus.com",
  clientId: "inv_xxxxxxxxxxxxxxxxxxxx", // from Developer Console
  redirectUri: "http://localhost:3456/callback", // or myapp://callback
});

// 1️⃣  Start login (opens browser)
await client.login();

// 2️⃣  In your redirect handler — exchange code for tokens
await client.handleRedirectCallback();   // reads ?code= from window.location

// 3️⃣  Check what the user purchased
const ent = await client.getEntitlements();
console.log(ent.status);     // "active" | "expired" | "none"
console.log(ent.plan);       // { id, name, interval }
console.log(ent.credits);    // { balance: 50 }
console.log(ent.features);   // ["export_pdf", "hd_render"]

// 4️⃣  Gate a feature
if (await client.isActive()) {
  // unlock premium feature
  await client.consume(1, crypto.randomUUID(), "hd_export");
}

SDK source: packages/innovorus-sdk — build with npm run build. Available as a private package from the agency dashboard.

Python quick-start

For CLI tools, desktop Python apps, or Electron-with-Python backends.

from innovorus_sdk import InnovorusClient

client = InnovorusClient(
    client_id="inv_xxxxxxxxxxxxxxxxxxxx",
    redirect_uri="http://localhost:3456/callback",
    base_url="https://www.innovorus.com",
)

# Generate PKCE pair and open browser
verifier, challenge = client.pkce_pair()
auth_url = client.authorize_url(challenge)
import webbrowser
webbrowser.open(auth_url)

# After the user is redirected back — paste or capture the code
code = input("Paste ?code= value: ")
tokens = client.exchange_code(code, verifier)

# Check entitlements
ent = client.get_entitlements()
print(ent["status"])      # "active"
print(ent["credits"])     # { "balance": 50 }

# Consume a credit
client.consume(1, idempotency_key="job-abc")

SDK source: packages/innovorus-sdk-python. Install with pip install -e packages/innovorus-sdk-python.

Server-side verification (API key)

Use a product API key (invk_…) on your own backend to check any buyer by email. Never put API keys in browser code.

import { InnovorusServerClient } from "@innovorus/sdk";

const srv = new InnovorusServerClient({
  apiKey: process.env.INNOVORUS_API_KEY!,  // invk_... from Developer Console
});

// Check by buyer email (e.g. from your own database)
const ent = await srv.getEntitlementsForUser({ email: "buyer@example.com" });
if (ent.status !== "active") throw new Error("No active subscription");

// Consume on behalf of the user (idempotent)
await srv.consumeForUser(
  { email: "buyer@example.com" },
  1,
  "render-job-" + jobId,
  "hd_render"
);

API endpoints

Redirect URI formats

Register any of these in the Developer Console → OAuth clients tab:

Webhooks (optional)

Register a URL in Developer Console → Webhooks. Innovorus sends an HMAC-SHA256 signature in X-Innovorus-Signature and the event type in X-Innovorus-Event.