cleetus.dev Get Cleetus

Cleetus accounts and membership

Cleetus accounts are shared by cleetus.app, this portal and the Cleetus IDE. Clients sign in with OpenID Connect against auth.cleetus.dev and check membership at api.cleetus.dev. This guide is the contract the IDE implements; any first-party tool can follow it.

Endpoints
Sign-in domain https://auth.cleetus.dev
Authorize https://auth.cleetus.dev/oauth2/authorize
Token https://auth.cleetus.dev/oauth2/token
Sign out https://auth.cleetus.dev/logout
Issuer and keys Published by the issuer's /.well-known/openid-configuration
API https://api.cleetus.dev
OpenAPI https://api.cleetus.dev/openapi.json

The API console shows the live issuer, client IDs and redirect URIs for the environment you are viewing.

Sign in from the IDE

Use the authorization code flow with PKCE (S256). The IDE client is public: it has no secret, so never embed one.

  1. Generate a random code_verifier and state, and derive the code_challenge.
  2. Start a loopback listener on http://localhost:47615/callback, or register the cleetus://auth/callback URL scheme with the operating system.
  3. Open the system browser at the authorize endpoint with response_type=code, the IDE client_id, that redirect_uri, scope=openid email profile, state and the challenge.
  4. On the callback, reject a mismatched state, then exchange the code and code_verifier at the token endpoint.
  5. Store the refresh token in the operating system's credential store. IDE refresh tokens last 90 days; ID and access tokens last one hour.

Always use the system browser, never an embedded web view. It keeps the user's password on the Cleetus sign-in page, and lets password managers and existing sessions work.

Check membership

curl -s https://api.cleetus.dev/v1/membership \
  -H "Authorization: Bearer $CLEETUS_TOKEN"

{
  "active": true,
  "plan": "member",
  "source": "subscription",
  "status": "active",
  "currentPeriodEnd": 1796083200,
  "cancelAtPeriodEnd": false,
  "mode": "live"
}

Gate member features on active and nothing else. status explains why, for messages such as "Your payment is past due", but statuses can be added. Either an ID or an access token works; send the ID token when you want the account email recorded.

Caching and offline use

  • Check on launch and when the user signs in, then at most every few hours while running.
  • Cache the last response with the time you received it. While offline, honour a cached active: true until currentPeriodEnd, so a flight never locks a paying member out.
  • After a 401, refresh the token once and retry. If refresh fails, ask the user to sign in.
  • After checkout in the browser, call POST /v1/membership/sync rather than waiting for the next scheduled check.

Buying and managing membership

Send people to https://cleetus.app/account to subscribe or manage billing. Payments are processed by Stripe for AdaptiveBase LLC. Clients never handle card details.