OAuth and user consent

Register an exact callback

Add each HTTPS redirect URI in Developer Console. Jotify compares the complete callback string and does not allow wildcard hosts, fragments or production HTTP.

• Keep development and production callbacks separate.
• Never place tokens in the redirect URI.
• Rotate the app secret if it is exposed.

Authorize with PKCE S256

Create a high-entropy verifier, send only its SHA-256 base64url challenge, show the user the exact requested scopes and require explicit consent.

POST /api/app-platform/oauth/authorize

{ "clientId": "jotify_…", "redirectUri": "https://app.example.com/oauth/callback", "scope": "profile:read", "state": "opaque-csrf-value", "codeChallenge": "base64url-sha256", "codeChallengeMethod": "S256", "consent": true }

Exchange and rotate

Exchange the single-use five-minute code from your backend with the original verifier and app secret. Access tokens last one hour; refresh tokens last 30 days and rotate on every refresh.

POST /api/app-platform/oauth/token

{ "grantType": "authorization_code", "clientId": "jotify_…", "clientSecret": "server-only-secret", "code": "single-use-code", "redirectUri": "https://app.example.com/oauth/callback", "codeVerifier": "original-verifier" }

Revocation

A user grant or app token can be revoked without exposing stored token values. Jotify stores token hashes only and fails closed when the app, grant or token is inactive.

GET  /api/app-platform/oauth/me
POST /api/app-platform/oauth/revoke