Function handleCallback

cmd/wasm/web/auth.js:93–126

()

// Returns the new API key on a successful exchange, null if there was no
// callback in progress, or throws on failure.
export async function handleCallback() {
  const params = new URLSearchParams(location.search);
  const code = params.get("code");
  if (!code) return null;

  const verifier = sessionStorage.getItem(VERIFIER_KEY);
  sessionStorage.removeItem(VERIFIER_KEY);

  // Always clean the URL, even on failure, so a stale ?code= doesn't haunt
  // future loads.
  history.replaceState({}, "", callbackURL());

  if (!verifier) {
    throw new Error("PKCE verifier missing — please click Sign in again.");
  }

  const r = await fetch("https://openrouter.ai/api/v1/auth/keys", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      code,
      code_verifier: verifier,
      code_challenge_method: "S256",
    }),
  });
  if (!r.ok) {
    const body = await r.text().catch(() => "");
    throw new Error(`OpenRouter token exchange failed: ${r.status} ${body}`);
  }
  const { key } = await r.json();
  if (!key) throw new Error("OpenRouter token exchange returned no key");
  localStorage.setItem(STORAGE_KEY, key);
  return key;
}

// getKey returns the stored API key, or null if the user is not signed in.
export function getKey() {