> ## Documentation Index
> Fetch the complete documentation index at: https://docs.postsider.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PostSider OAuth apps and pos_ tokens

> Register third-party applications against your organization and issue pos_ tokens for the public API.

PostSider includes an OAuth authorization server that lets third-party applications access your organization's public API on behalf of your users. Tokens minted this way use the `pos_...` prefix and are accepted in the `Authorization` header alongside API keys.

<Note>
  This flow is API-only today - there is no dashboard UI for registering apps. Use the endpoints below directly.
</Note>

## Registering an app

Create an OAuth app for your organization to receive a client id and secret:

* `POST /user/oauth-app` - create an app; returns a `pca_...` client id and a `pcs_...` client secret (shown once, stored encrypted).
* Rotate the secret with the app's rotate-secret endpoint if it is ever exposed.
* `DELETE /user/oauth-app/:id` - delete an app.

## Authorization flow

1. Send the user to the authorization endpoint with your client id and a `redirect_uri`; PostSider validates the redirect URI against the registered app.
2. The user approves the request.
3. Exchange the returned code for a token at `POST /oauth/token`, which mints a `pos_...` bearer token.
4. Use the token as the `Authorization` header on `/public/v1` requests (no `Bearer` prefix).

## Revoking access

Users can list and revoke approved applications from their account (`approved-apps` endpoints). Revoking invalidates the associated tokens. Treat `pos_` tokens like API keys: they grant access to the organization's public API surface until revoked.