VelaFold Auth
Contact

OAuth 2.0 Centralized broker for VelaFold websites

The secure gateway to the VelaFold ecosystem

VelaFoldAuth is operated by VelaFold to connect approved VelaFold websites with Google Sign-In, Drive backup storage, and Calendar workflow events.

Request access Read the Privacy Policy
  • Single-use codes
  • 5-minute expiry
  • Encrypted via TLS
  • Google Limited Use
auth.velafold.com Secure

Authorization flow

  1. Registered websiteclient_key · redirect_uri
    GET /auth
  2. VelaFoldAuthValidates client and pre-approved callback
    verify
  3. Google consentUser approves only the requested feature
    OAuth
  4. Broker codeSingle-use, expires in 5 minutes
    POST 
# server-to-server exchange
POST /verify-code
client_key="…"&client_secret="…"&code="…"

# → 200 OK
{ "email": "…", "name": "…", "id": "…" }

Services

Three Google integrations, one trusted broker.

Each flow requests only the scopes its feature needs, and access starts only when a user begins a Google authorization flow from a registered VelaFold website.

Google Sign-In

Authenticates website administrators with their Google account — no extra passwords to manage.

  • email
  • profile

Google Drive backups

Stores and manages website backup archives in the user's own Google Drive.

  • drive.file

Google Calendar

Views, creates, and updates the events used by configured website workflows.

  • calendar.events
  • userinfo.email

How it works

Google access, disclosed clearly.

VelaFoldAuth validates the requesting website before returning any Google Sign-In, Drive, or Calendar authorization result.

  1. Initiate

    A registered website redirects the user with its client_key and callback address.

  2. Validate

    The broker confirms the client is active and the redirect URI is pre-approved.

  3. Authorize

    The user signs in with Google and consents to the specific feature requested.

  4. Exchange

    The website trades a single-use broker code for the result over an authenticated server-to-server call.

5 minMaximum lifetime of any broker code
1×Codes are deleted the moment they are exchanged
0Tracking, analytics, or advertising cookies

Transparency

Google user data requested and why

Access starts only when a user begins a Google authorization flow from a registered VelaFold website.

VelaFoldAuth adheres to the Google API Services User Data Policy. Read the full Privacy Policy.

  • Sign-In

    Email, profile name, profile photo, and Google account ID authenticate website administrators.

  • Drive

    Drive file access stores and manages website backup archives in the user's Google Drive.

  • Calendar

    Calendar event access views, creates, and updates events used by configured website workflows.

  • Limited use

    Data is shared only with the registered website that requested it and is not sold, used for ads, or used for profiling.

Have an integration?

Access is limited to websites registered and approved by VelaFold. Get in touch to request a client key.

Request access Review service terms