Skip to main content

​
Overview

We are an OAuth 2.0 provider. Your app sends a user to us, they approve the access you asked for, and we hand back a bearer token. Your app uses that token to call the API on behalf of that user. This is the same model as “Login with GitHub”. It is OAuth 2.0, not OpenID Connect, so there is no id_token. To read the identity of the user who approved access, call GET /api/v1/user with the profile:read scope.

Quickstart

Go from a registered app to a logged in user and their profile in a few minutes.

Authorization code

The full user consent flow with PKCE for apps acting on behalf of a user.

Client credentials

A server to server flow for your own backend, with no user prompt.

Scopes

Every scope you can request and what each one grants.

Versioning

Dated API versions, the version header, and how to pin a version.

Endpoints

The token and authorize endpoints that issue and refresh tokens.

​
Which flow do I use

Acting for a user

A third party app where people sign in with their own account. Use the authorization code flow. Register a Web application.

Acting for yourself

Your own backend using your own account, with no other users. Use the client credentials flow. Register a Service application.

​
Base URLs

The authorization endpoints are unversioned. The REST API is served under /api/v1.

​
Register an application

Applications are created in the console. Open Settings, then Applications, then create an application.
1

Choose a type

Pick Web application for the authorization code flow, or Service for the client credentials flow.
2

Add redirect URIs

Web applications must list every redirect URI they will use. We match the redirect_uri on each request against this list exactly.
3

Select scopes

Grant only the scopes your app needs. See Scopes.
4

Copy the credentials

You receive a client_id and a client_secret. The secret is shown once. Store it server side and never ship it to a browser.

​
Tokens at a glance

Access token

A bearer token sent as Authorization: Bearer <token>. It is valid for one hour.

Refresh token

Returned by the authorization code flow. It is valid for thirty days and rotates every time you use it. The client credentials flow does not use refresh tokens.
The client_secret, access tokens, and refresh tokens are confidential. Keep them on your server. A user can revoke your app at any time from their account settings.