Build on the market, not on a model

OAuth 2.1 authorization code flow with PKCE (S256 required). People connect their Bestex account in one click and your app runs requests on their balance. Nobody pastes a key.

• App fee: 0–100% on top of what Bestex charges. 90% accrues to your app, 10% goes to the vault. Taken only from a user's paid balance, never from trial credit.
• Tokens: access tokens last 1 hour; refresh tokens are single use and rotate on every refresh.
• Any grade: put the grade in the model name, exactly as with an API key.

GET  /oauth/authorize?response_type=code&client_id=…&redirect_uri=…
       &scope=inference&state=…&code_challenge=…&code_challenge_method=S256
POST /api/oauth/token    grant_type=authorization_code&code=…&code_verifier=…
                         → { access_token, refresh_token, expires_in: 3600 }
POST /api/oauth/token    grant_type=refresh_token&refresh_token=…
GET  /api/oauth/userinfo → { sub, address, email, tier, balance_usd }
POST /api/oauth/revoke   token=…
Authorization: Bearer <access_token>   → works wherever an API key does

Register an app →

Discovery document: /.well-known/openid-configuration. Each response through your app carries x-bestex-app-fee.