Skip to content
korAPI

OAuth 2.0

Choose OAuth 2.0 on the Auth tab. korAPI supports two grants:

The Auth tab set to OAuth 2.0 with the authorization code grant.
  • Client Credentials, for one service talking to another.
  • Authorization Code with PKCE (S256), for signing in as a person.

The client authenticates with a Basic header (the default) or in the body; a public client sends only its client_id. Extra parameters you add go both into the sign-in URL and into the token request.

Signing in

Section titled “Signing in”

With a custom-scheme redirect, you sign in inside a private window of korAPI. With a redirect to http://127.0.0.1:<port>/…, korAPI opens your system browser and waits on that port; some providers, Google among them, need this. Signing in times out after 5 minutes.

Tokens

Section titled “Tokens”

Tokens are kept in your system keychain, separately for each environment. korAPI refreshes a token 30 seconds before it expires, and never asks for one for a locked production environment.