OAuth 2.0 apps

Let other Origin Platform businesses connect your app without sharing API keys.

1. Register the app

Dashboard > Developers and API > Apps. Confidential apps (a server) get a client secret; public apps (single-page or mobile) do not. Register every exact redirect URL (https, or http://localhost while developing).

2. Authorization code with PKCE

PKCE with S256 is required for every app. Send the admin of the business to:

GET /oauth/authorize?response_type=code&client_id=opc_...&redirect_uri=https://yourapp.example/callback
    &scope=contacts:read%20revenue_engine:write&state=<random>&code_challenge=<base64url(sha256(verifier))>&code_challenge_method=S256

After approval we redirect to redirect_uri?code=...&state=...&iss=.... Codes are single use and expire after 10 minutes. Check state.

curl -X POST /api/oauth/token \
  -u "opc_...:opcs_..." \
  -d grant_type=authorization_code -d code=opac_... \
  -d redirect_uri=https://yourapp.example/callback -d code_verifier=<verifier>

3. Call the API

Use the access token (opat_..., 1 hour) exactly like an API key. It acts for the business that approved the app, with the approved scopes only. Admins can disconnect the app at any time, which revokes its tokens.

Discovery: /.well-known/oauth-authorization-server (RFC 8414).