> For the complete documentation index, see [llms.txt](https://vampauth.gitbook.io/vampauth-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vampauth.gitbook.io/vampauth-docs/api-reference/browser-routes/flow-and-callbacks.md).

# Flow and provider callback routes

These routes serve the public key flow. They use its browser session cookie and single-use capabilities, not a management token. Start/renew/stack requests require fresh captcha verification.

| Method            | Route                                   | Purpose                                                     |
| ----------------- | --------------------------------------- | ----------------------------------------------------------- |
| GET               | /api/flow                               | Current public project offer/progress/keys                  |
| POST              | /api/checkpoints/start                  | Start/resume an eligible provider/package flow              |
| POST              | /api/checkpoints/cancel                 | Cancel the browser's flow                                   |
| POST              | /api/flow/renew/start                   | Start a fresh flow for a specific expired session-owned key |
| POST              | /api/flow/stack/start                   | Repeat an active key's original package to add time         |
| POST              | /api/flow/discord/start                 | Begin the pending Discord OAuth claim                       |
| GET               | /api/flow/discord/callback              | Receive Discord OAuth return                                |
| POST              | /api/flow/discord/claim                 | Finish the eligible Discord claim/reward                    |
| POST              | /api/integrations/linkvertise/callback  | Verify Linkvertise completion                               |
| GET               | /api/integrations/lootlabs/callback     | Consume LootLabs return                                     |
| GET               | /api/integrations/workink/callback      | Consume Work.ink return                                     |
| GET               | /api/integrations/linkunlocker/callback | Consume LinkUnlocker return                                 |
| GET               | /api/licenses                           | Public browser-owned key view                               |
| GET, POST, DELETE | /api/protection-pass                    | Check/obtain/clear a browser protection pass                |

The flow page is /{project-identifier}/flow. The Linkvertise return page is /c/{callback\_id}/complete; it is a page, not an arbitrary completion-grant API.

## Common request fields

Flow data is looked up with project\_id. Start uses the selected provider/package and a turnstile\_token. Renewal adds the exact expired key; stacking uses the exact active key and its original package. The server resolves current terms and session ownership; client fields can't supply a reward duration or another user's session identity.

Provider callbacks carry the attempt's own proof/token/hash. Don't save them as permanent public entry links or call them from a custom client to manufacture progress. Use the real provider navigation.

Renew/stack starts are limited to five requests/minute/IP. A pending claim or another active flow can return a conflict. An expired/cancelled attempt cannot complete a new run.

## Public utility routes

GET /api/health returns application/database health. GET /llms.txt and GET /llms-full.txt serve machine-readable site information. They don't authenticate a player or expose account credentials.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://vampauth.gitbook.io/vampauth-docs/api-reference/browser-routes/flow-and-callbacks.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.