Account Hosting API

curl -X POST "https://beta-api.derouter.network/api/containers/claude-oauth/authorize" \
  -H "Authorization: Bearer sk-mgr-YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"region": "sgp"}'

# => { "auth_url": "https://claude.ai/oauth/authorize?...", "session_id": "3f9a2e1b..." }
# KEEP session_id — you pass it back in step 2 (exchange). It links the two calls.
# open auth_url in the END USER's browser (not your server's).
# region picks the egress IP; token is minted from that same IP (revoke-safe).
# region is optional (default sgp) but fixed once set — to change it, call authorize again.

curl -X POST "https://beta-api.derouter.network/api/containers/claude-oauth/exchange" \
  -H "Authorization: Bearer sk-mgr-YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "session_id": "3f9a2e1b...",
    "code": "xxxxxxxxxxxxxxxx#yyyyyyyyyyyy"
  }'

# => { "status": "running", "account_id": "2eab80c1-...", "email": "user@example.com", "plan": "max", ... }
# session_id = the one returned by authorize in step 1 (that's where it comes from).
#   Expires in 30 min, single-use.
# code = the Authorization Code shown on the claude.ai callback page
# (the user copies + sends it to you). NOT a sessionKey (sk-ant-sid...).

curl -X POST "https://beta-api.derouter.network/api/containers/claude-oauth/cookie-auth" \
  -H "Authorization: Bearer sk-mgr-YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "session_key": "sk-ant-sid01-…",
    "region": "sgp"
  }'

# region picks the egress IP; token is minted from that same IP (revoke-safe).
# region optional (default sgp). Returns the container + account_id.

curl -X POST "https://beta-api.derouter.network/api/containers/claude-oauth/bulk-cookies" \
  -H "Authorization: Bearer sk-mgr-YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "session_keys": [
      { "session_key": "sk-ant-sid01-…", "region": "sgp" }
    ],
    "options": { "default_region": "sgp" }
  }'

# <=50 per batch; email dedup is always on.
# If the email matches one of YOUR wallet's already-expired accounts, it is
# re-authenticated in place instead of skipped (result.reauth: true).
# Keep one region per batch (single-IP regions throttle if overloaded).
#
# result.status is one of: added | skipped | failed | pending.
#   pending = accepted and still completing server-side; it is NOT a failure.
#             Re-check the account list rather than retrying immediately.
# Resubmitting is always safe: a key that already landed is deduped, so a
# retry can never create a second account.

curl -X POST "https://beta-api.derouter.network/api/containers/codex/bulk-refresh-tokens" \
  -H "Authorization: Bearer sk-mgr-YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "refresh_tokens": [
      { "refresh_token": "rt.1.…", "region": "sgp" }
    ],
    "options": { "default_region": "sgp" }
  }'

# The token is tokens.refresh_token from ~/.codex/auth.json (prefix "rt.").
# <=50 per batch; dedup key is (email, plan) — one ChatGPT email may legitimately
# hold several plans.
#
# ⚠ THE EXCHANGE CONSUMES THE TOKEN. OpenAI rotates it and we keep the new one,
#   so any other copy — including the ~/.codex it came from — stops working.
#   Only import accounts you are done using elsewhere.
#
# result.status is one of: added | skipped | failed | pending  (same as above).
# result.rotated tells you the pasted token was replaced.
#
# Unlike the Claude batch, resubmitting is NOT free: a token that already landed
# is dead, so a blind retry reports refresh_token_invalid. Re-check the account
# list first. Two codes say the token is gone for good and a fresh
# 'codex login' is required: exchange_response_lost, refresh_token_invalid.