From cfa4c6aa653c87c4d1bfe6f6e27cd8efbf289916 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 5 Aug 2026 17:08:14 +0000
Subject: [PATCH 1/2] docs(oauth): document authorization code expiry

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 skills/openrouter-oauth/SKILL.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/skills/openrouter-oauth/SKILL.md b/skills/openrouter-oauth/SKILL.md
index 97e14eb..7466afc 100644
--- a/skills/openrouter-oauth/SKILL.md
+++ b/skills/openrouter-oauth/SKILL.md
@@ -69,6 +69,11 @@ Content-Type: application/json
 → { "key": "sk-or-..." }
 ```
 
+Authorization codes expire 10 minutes after issuance. If the exchange returns
+`403 Authorization code expired`, restart the OAuth flow and exchange the new
+code promptly. Treat authorization codes as short-lived, one-time values and
+do not persist or retry an expired code.
+
 Remove the verifier from `sessionStorage` before or after the exchange.
 
 ### Step 5: Store the key and clean up

From 7966bedf32cbf7993115ed7aa2c4557038b27726 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 5 Aug 2026 17:10:44 +0000
Subject: [PATCH 2/2] docs(oauth): trim expiry guidance

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 skills/openrouter-oauth/SKILL.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/skills/openrouter-oauth/SKILL.md b/skills/openrouter-oauth/SKILL.md
index 7466afc..7824205 100644
--- a/skills/openrouter-oauth/SKILL.md
+++ b/skills/openrouter-oauth/SKILL.md
@@ -71,8 +71,7 @@ Content-Type: application/json
 
 Authorization codes expire 10 minutes after issuance. If the exchange returns
 `403 Authorization code expired`, restart the OAuth flow and exchange the new
-code promptly. Treat authorization codes as short-lived, one-time values and
-do not persist or retry an expired code.
+code promptly.
 
 Remove the verifier from `sessionStorage` before or after the exchange.