Skip to main content
Build an OAuth app when other people will connect your software to their own StockShift account. Each member who connects it chooses the organization and approves the scopes, and the token your app gets can never do more than that member could. StockShift is an OAuth 2.1 authorization server. Apps use the authorization code flow with PKCE (S256). There is no client secret.

​
Endpoints

All of them are on the app host, https://app.stockshift.io.

​
The flow

1

Register your app

Register once with your app’s name and redirect URIs. The answer holds your client_id.
2

Send the member to the consent page

Make a code verifier and its S256 challenge, then open /oauth/authorize with your client_id, redirect_uri, the scope you want, a state and the code_challenge.The member signs in, picks the organization and chooses what your app may do, module by module. See is on and Change is off to begin with, and they can offer only what their own permissions allow. An app anyone can register shows an Unverified app badge.
3

Swap the code for tokens

StockShift sends the member back to your redirect URI with a code, or with error=access_denied if they pressed Deny. Post the code and your code verifier to /oauth/token.
4

Call the API

Send the access token as Authorization: Bearer <token>, as you would an API key.

​
Token lifetimes

Access tokens last an hour. Refresh tokens last 30 days, and each refresh returns a new one, so store it every time. The SDKs take a function for the token, which they call before each request, so you can refresh as you go:

​
When access ends

A member sees the apps they connected under Settings > Connected apps and can revoke one at any time. The organization’s owner sees everyone’s. When an app is revoked, or the member who connected it leaves the organization, its tokens stop working at once and it must ask for access again.