Search FoundrList
Search launches, makers and skills, or jump to a page
Build for founders.
Let founders sign in with their FoundrList account, read their profile and spend with consent, and bring public launch data into your product. Free, with standard OAuth 2.0.
On your sign-in page
One button. Founders approve exactly what you ask for.
Sign in with FoundrList- Name, username and verified badge
profile - Email address
email - Total spend on FoundrList
spend:read
GET /api/oauth/userinfoAuthorization: Bearer flat_…{ "sub": "8f3c2a9e-41d7-4c5b-9e0a-3b6f1d2c7e58", "name": "Ada Lovelace", "username": "ada", "picture": "https://…/avatar.png", "profile": "https://www.foundrlist.com/@ada", "verified": true, "email": "ada@example.com", "email_verified": true}What you can build. Six building blocks, ready today.
Live in an afternoon. Three steps, any stack.
Create an app
Register in the console and add your callback URL. You get a client ID and secret in seconds.
Redirect to FoundrList
Your server sends founders to FoundrList with a fresh state and PKCE challenge.
Exchange the code
Swap the code for tokens on your server, then read the founder's profile.
// GET /auth/foundrlist: start sign-inimport crypto from "node:crypto";const b64 = (bytes) => bytes.toString("base64url");export async function GET() { const state = b64(crypto.randomBytes(16)); const verifier = b64(crypto.randomBytes(32)); const hash = crypto.createHash("sha256").update(verifier); const challenge = b64(hash.digest()); // Keep both in an httpOnly session for the callback. await session.set({ state, verifier }); const url = new URL("https://www.foundrlist.com/oauth/authorize"); url.search = new URLSearchParams({ response_type: "code", client_id: process.env.FOUNDRLIST_CLIENT_ID, redirect_uri: "https://your-site.com/auth/foundrlist/callback", scope: "profile email", state, code_challenge: challenge, code_challenge_method: "S256", }).toString(); return Response.redirect(url, 302);}Built the way developers expect. Secure from the first line.
Standard OAuth 2.0. Authorization code flow with PKCE and a discovery document. Any OAuth library works.
Secure by default. Hashed secrets and tokens, rotating refresh tokens, and one-click secret rotation.
Founder consent. Founders see exactly what you ask for, and can disconnect your app at any time.
Server-to-server spend. Refresh a connected founder's spend with just their email and your credentials.
Referral links. Every app gets a tracked referral link, with clicks counted in your console.
Partner discounts. Verified partners give their users a discount, applied automatically at checkout.
Questions.
Yes. Creating apps, Sign in with FoundrList, and the public data endpoints are free.
With the founder's consent: their profile (name, username, avatar, verified status), email, and total spend on FoundrList. Never individual orders or card details. See scopes.
Any. It's standard OAuth 2.0 with PKCE, so it works with your existing OAuth library or a few lines of server code. The quickstart has Node.js, Python and cURL examples.
Each account can create up to 5 apps. API rate limits are listed under errors and rate limits.
Request only the scopes you need, protect founders' data, and never sell it. The full rules are in the developer section of our Terms.