GoRunner docs
Search or askSearch⌘K

Read a sign-in request

Since v2026.10.23

GET/api/embed/v1/oauth-requests/{requestId}

Reads what an AI app’s sign-in request is for, after the person signed in to your product.

Needs a partner key: Authorization: Bearer gre_…, from Platform › Partner keys. Call it from your server only.

Embed · Self-hosted with an Embed license

Parameters

Path

requestIdRequired · string

The request’s ID: the gr_request parameter on the address the person arrived at.

Read the account here

The installation sends the person to your sign-in address with only ?gr_request=…. Read the account here, never from the link, and only after the person signed in: anyone with an account’s AI app address can start a request.

Check they belong to that account, then ask them to confirm: “Connect Claude (claude.ai) to Bakery Ltd?”. client.name is the name the app chose itself. Then sign them in or turn it down.

It isn’t audited, and counts against your key’s own budget for these requests: 600 a minute (EMBED_OAUTH_REQUEST_RATE_LIMIT).

Responses

  • 200OK

    The request.

  • No such request: unknown, past its 15 minutes, or answered and gone. Tell the person: “This connection request has expired. Go back to your AI app and connect again.” An installation without AI app sign-in (before v2026.10.23) answers a bare 404 too.

  • Something failed on the installation’s side. Try again.

Any call can also answer: 401 UNAUTHORIZED · 403 EMBED_NOT_LICENSED · 403 IP_NOT_ALLOWED · 429 RATE_LIMITED · 503 BUSY. See Errors.

Request

GORUNNER="https://automations.example.com"
GORUNNER_EMBED_KEY="YOUR_PARTNER_KEY"  # gre_…
REQUEST_ID="q7Kd2mXr9TfL0aZc3vBn8wYe"  # gr_request from the address

curl "$GORUNNER/api/embed/v1/oauth-requests/$REQUEST_ID" \
  -H "Authorization: Bearer $GORUNNER_EMBED_KEY"

Response · 200 OK

json
{
  "data": {
    "id": "q7Kd2mXr9TfL0aZc3vBn8wYe",
    "account": {
      "id": "acct-bakery",
      "name": "Bakery Ltd"
    },
    "client": {
      "name": "Claude",
      "redirectHost": "claude.ai",
      "kind": "web"
    },
    "surface": "tools",
    "status": "waiting",
    "expiresAt": "2026-10-25T09:15:00Z"
  }
}
Every field

It takes no body.

Response · 200 OK

dataobject
idstring
accountobject
idstring

Your account id.

namestring
clientobject
namestring

The application’s name, as its registration claims it.

redirectHoststring

Where its code would go: a host, or an app’s callback.

kindstring

One of web, loopback, app.

surfacestring

One of build, tools.

statusstring

One of waiting, done.

expiresAttime