> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stockshift.io/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth apps

> Let other StockShift customers connect your app to their account with OAuth 2.1.

Build an OAuth app when other people will connect your software to their own StockShift account. Each member who connects it chooses the organization and approves the scopes, and the token your app gets can never do more than that member could.

StockShift is an OAuth 2.1 authorization server. Apps use the authorization code flow with PKCE (`S256`). There is no client secret.

## Endpoints

All of them are on the app host, `https://app.stockshift.io`.

| Endpoint | What it is for |
| - | - |
| `GET /.well-known/oauth-authorization-server` | Server metadata ([RFC 8414](https://www.rfc-editor.org/rfc/rfc8414)). Discover the other endpoints from here. |
| `POST /oauth/register` | Register your app ([RFC 7591](https://www.rfc-editor.org/rfc/rfc7591)). Limited to 10 an hour from each IP address. |
| `GET /oauth/authorize` | Send the member here to sign in and approve your app. |
| `POST /oauth/token` | Swap the code for tokens, and refresh them. |

## The flow

**1. Register your app**

Register once with your app's name and redirect URIs. The answer holds your `client_id`.

**2. Send the member to the consent page**

Make a code verifier and its `S256` challenge, then open `/oauth/authorize` with your `client_id`, `redirect_uri`, the `scope` you want, a `state` and the `code_challenge`.

The member signs in, picks the organization and chooses what your app may do, module by module. See is on and Change is off to begin with, and they can offer only what their own permissions allow. An app anyone can register shows an **Unverified app** badge.

**3. Swap the code for tokens**

StockShift sends the member back to your redirect URI with a `code`, or with `error=access_denied` if they pressed **Deny**. Post the code and your code verifier to `/oauth/token`.

**4. Call the API**

Send the access token as `Authorization: Bearer <token>`, as you would an API key.

## Token lifetimes

Access tokens last an hour. Refresh tokens last 30 days, and each refresh returns a new one, so store it every time.

The SDKs take a function for the token, which they call before each request, so you can refresh as you go:

```ts theme={null}
const stockshift = new StockShift({ token: () => tokens.current() });
```

## When access ends

A member sees the apps they connected under **Settings > Connected apps** and can revoke one at any time. The organization's owner sees everyone's. When an app is revoked, or the member who connected it leaves the organization, its tokens stop working at once and it must ask for access again.


## Related topics

- [StockShift for developers](https://docs.stockshift.io/index.md)
- [Unsubscribe a REST hook](https://docs.stockshift.io/api-reference/rest-hooks/unsubscribe-a-rest-hook.md)
- [Subscribe a REST hook](https://docs.stockshift.io/api-reference/rest-hooks/subscribe-a-rest-hook.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.