Overview

Deli is OAuth for API keys. It lets users store their API keys securely and grant scoped access to third-party platforms — without ever exposing the raw key.

There are three actors in the Deli ecosystem:

Quick Start for Developers

1. 1. Register a developer account

   Sign up at withdeli.com/auth/register

2. 2. Create an application

   In the dashboard, create a new app to get your client_id and client_secret.

3. 3. Implement the OAuth flow

   Redirect users to the authorization endpoint:

   GET https://api.withdeli.com/oauth/authorize
     ?client_id=YOUR_CLIENT_ID
     &redirect_uri=https://yourapp.com/callback
     &response_type=code
     &scope=openai
     &code_challenge=CHALLENGE
     &code_challenge_method=S256

4. 4. Exchange code for token

   POST https://api.withdeli.com/oauth/token
   Content-Type: application/json
   
   {
     "grant_type": "authorization_code",
     "code": "AUTH_CODE",
     "client_id": "YOUR_CLIENT_ID",
     "redirect_uri": "https://yourapp.com/callback",
     "code_verifier": "VERIFIER"
   }

5. 5. Proxy API calls

   POST https://api.withdeli.com/proxy/openai/chat/completions
   Authorization: Bearer ACCESS_TOKEN
   
   {
     "model": "gpt-4o",
     "messages": [{ "role": "user", "content": "Hello" }]
   }

OAuth 2.0 Flow

Deli implements the Authorization Code flow with PKCE (Proof Key for Code Exchange), the industry standard for secure OAuth.

API Proxy

Deli acts as a transparent proxy. Your API calls are forwarded to the upstream provider using the user's stored key. The response is passed back unmodified.

POST https://api.withdeli.com/proxy/{service}/*
Authorization: Bearer ACCESS_TOKEN

Supported Services

The path after the service name is forwarded as-is. For example, proxy/openai/chat/completions proxies to OpenAI's /v1/chat/completions.

User Key Management

Users store their API keys through the Deli portal or API. Keys are encrypted at rest and never exposed to third-party platforms.

# Store a key
POST /api/user/keys
{ "service": "openai", "apiKey": "sk-...", "label": "My GPT key" }

# List keys (keys are masked)
GET /api/user/keys

# Delete a key
DELETE /api/user/keys/:id

Agent Authentication

AI agents authenticate using the client credentials flow. Developers create agents in their app settings and generate scoped tokens.

# Generate agent token (client credentials)
POST /api/agents/token
{ "client_id": "deli_agent_...", "client_secret": "deli_secret_..." }

# Use agent token for proxy calls
POST /api/proxy/openai/chat/completions
Authorization: Bearer AGENT_TOKEN

API Reference

SDK

The official JavaScript/TypeScript SDK handles OAuth flows, token management, and proxied API calls.

npm install @deli/sdk

import { DeliClient } from '@deli/sdk';

const deli = new DeliClient({
  clientId: 'YOUR_CLIENT_ID',
  redirectUri: 'https://yourapp.com/callback',
});

// Start OAuth flow
const authUrl = deli.getAuthorizationUrl({ scope: 'openai' });

// Exchange code
const tokens = await deli.exchangeCode(code);

// Proxy a call
const response = await deli.proxy('openai', '/chat/completions', {
  model: 'gpt-4o',
  messages: [{ role: 'user', content: 'Hello' }],
});

Data Governance

Deli supports configurable data retention modes per user. Control what metadata is stored when requests pass through the proxy.

API

# Set governance mode
PUT /api/v1/governance/configure
{ "mode": "zero-retention" }

# Check current mode
GET /api/v1/governance/status/me

# Verify what data is retained
GET /api/v1/governance/verify/me

SDK

// Configure zero retention
await deli.governance.configure('zero-retention');

// Check current status
const status = await deli.governance.status();

CLI

deli governance set --mode zero-retention
deli governance status