Developers
Connected Apps & OAuth
Let other apps and AI assistants act on a user’s behalf with OAuth 2.1, and manage or disconnect them.
OAuth lets an app use someone's X Image Splitter account without ever seeing their password. The person approves the app once, choosing what it may do, and can disconnect it at any time. Approved apps are called Connected Apps.
Use OAuth when you build an app or an AI integration for other people, or when you connect an AI assistant to your own account through MCP. For your own scripts, an API Key is simpler.
What the person sees
When an app asks for access, the person signs in (if they aren't already) and sees a consent screen with:
- the app's name, and the web address its registration came from;
- every Scope requested, with its plain-language description, such as "Start generations that spend your credits".
Approving connects the app. Declining sends the person back to the app with no access granted.
Manage Connected Apps
Account › Connected Apps lists every app you approved, with its origin URL, its Scopes, and when you connected it.
Select Disconnect to remove an app. Its access ends immediately, including all tokens previously issued. Reconnecting requires running the authorization flow again.
For developers: the authorization flow
X Image Splitter is an OAuth 2.1 authorization server. The flow is the authorization code flow with PKCE:
| Step | Details |
|---|---|
| Discover | https://ximagesplitter.com/.well-known/oauth-authorization-server/api/auth lists the endpoints. Each API publishes protected-resource metadata under https://ximagesplitter.com/.well-known/oauth-protected-resource/…. |
| Identify your app | Your client_id is the https URL of your app's client metadata document (Client ID Metadata Document). There is no manual registration step and no client secret to store. |
| Authorize | Send the person to https://ximagesplitter.com/api/auth/oauth2/authorize with response_type=code, your redirect_uri, the scope you need, a PKCE code_challenge with code_challenge_method=S256, and the resource you want a token for. |
| Exchange the code | POST the code and your code_verifier to https://ximagesplitter.com/api/auth/oauth2/token. |
| Call the API | Send the access token as Authorization: Bearer <token>. |
The resource decides where a token is valid:
A token is accepted only by the resource it was issued for.
Scopes
Request only the Scopes your integration requires, matching the identifiers used by API Keys (e.g. generations:read creations:read). The complete list is defined in API Keys › Scopes. Each operation in the API Reference specifies its required Scope.
When access is refused
401 Unauthorized(withWWW-Authenticateheader): the access token is missing, invalid, expired, or the user disconnected your app. Initiate the authorization flow again.403 Forbidden(insufficient_scope): the access token is valid but lacks the required Scope. Initiate a new authorization request including the missing Scope.
Payments stay with the person
Even with billing:write, an app only receives a checkout or confirmation
link. The person opens it and completes the payment themselves.