Skip to main content
PostSider includes an OAuth authorization server that lets third-party applications access your organization’s public API on behalf of your users. Tokens minted this way use the pos_... prefix and are accepted in the Authorization header alongside API keys.
This flow is API-only today - there is no dashboard UI for registering apps. Use the endpoints below directly.

​
Registering an app

Create an OAuth app for your organization to receive a client id and secret:
  • POST /user/oauth-app - create an app; returns a pca_... client id and a pcs_... client secret (shown once, stored encrypted).
  • Rotate the secret with the app’s rotate-secret endpoint if it is ever exposed.
  • DELETE /user/oauth-app/:id - delete an app.

​
Authorization flow

  1. Send the user to the authorization endpoint with your client id and a redirect_uri; PostSider validates the redirect URI against the registered app.
  2. The user approves the request.
  3. Exchange the returned code for a token at POST /oauth/token, which mints a pos_... bearer token.
  4. Use the token as the Authorization header on /public/v1 requests (no Bearer prefix).

​
Revoking access

Users can list and revoke approved applications from their account (approved-apps endpoints). Revoking invalidates the associated tokens. Treat pos_ tokens like API keys: they grant access to the organization’s public API surface until revoked.