Calm API, MCP, install, and console surfaces for working with AYA’s digital twin system.
Developer Platform
Auth / OAuth
Docs
Auth / OAuth
Workspace auth model, OAuth install flow, token lifecycle, and reconnects.
Auth / OAuth
Three auth modes can coexist without forking the platform
AYA preserves internal bearer-token dogfood, workspace API keys for manual/beta use, and OAuth bearer tokens for public installs. All three resolve back to the same workspace and install model.
http
Authorization: Bearer <oauth-access-token> # or for developer / beta manual useX-Api-Key: aya_test_...
Workspace model
Installs are tied to a signed-in user, a chosen workspace, and a canonical installation record
That mapping is what keeps reconnects, console visibility, and revocation behavior coherent across Claude and ChatGPT.
The authorize step validates the client and redirect before asking for workspace confirmation.
Tokens are issued and refreshed against the same install record instead of creating a second account model.
The console surfaces install status so users have a clear reconnect path.
Endpoints
Authorize, token, and revoke routes
The OAuth endpoints live on the same developer-facing surface and are already wired into the shared gateway foundation.
http
GET /oauth/authorizePOST /oauth/tokenPOST /oauth/revoke
On this page