Implementation

Register an app and run the OAuth sign-in flow.

4 min read

Connect your agent today

Draft from chat, review in your calendar, and publish only what you approve.

Flow overview

Register the redirect URL on your OAuth app. RedPanda checks it when the user approves. You do not send redirect_uri in the token request.

Register your OAuth app

In the RedPanda dashboard, go to:

Account → Settings → Developers → Apps

Create an OAuth application and provide:

App name — displayed to users on the consent screen
Description (optional)
Profile picture (optional)
Redirect URL — where RedPanda sends users after they approve/deny access

After creation you’ll receive:

Client ID — public identifier (prefix oqc_...)
Client secret — secret key for token exchange (prefix oqs_...)

Danger

Copy the client secret immediately and store it securely. If you lose it, rotate it from the same settings page.

Redirect users to authorize

Redirect the user to:

OPENQUOK_FRONTEND_URL/oauth/authorize?client_id=CLIENT_ID&response_type=code&state=STATE

Parameter	Required	Description
client_id	Yes	Your app’s Client ID (starts with oqc_)
response_type	Yes	Must be code
state	No	A random string to prevent CSRF attacks. Recommended.

OPENQUOK_FRONTEND_URL is the RedPanda web origin (for example https://web-production-ce4be0.up.railway.app)

Example:

https://web-production-ce4be0.up.railway.app/oauth/authorize?client_id=oqc_your_client_id&response_type=code&state=random123

Example value	What it is
https://web-production-ce4be0.up.railway.app	RedPanda frontend origin (your OPENQUOK_FRONTEND_URL)
oqc_your_client_id	Your app’s Client ID
code	The only supported response_type
random123	Example state value

The user will see a consent screen showing your app’s name and description. They can choose Authorize or Deny.

Handle the callback

After the user approves, RedPanda redirects to your Redirect URL.

Approved:

https://yourapp.com/callback?code=abc123&state=random123

Query param	Required	Description
code	Yes	Authorization code (single-use; expires in 10 minutes)
state	No	The same state you sent in the authorize step

Denied:

https://yourapp.com/callback?error=access_denied&state=random123

Query param	Required	Description
error	Yes	access_denied when the user denies the request
state	No	The same state you sent in the authorize step

Verify the state value matches what you sent.

Exchange code for a token

Make a server-side request to exchange the authorization code for an access token.

curl -X POST https://api-production-a424.up.railway.app/api/v1/oauth/token 
  -H "Content-Type: application/json" 
  -d '{
    "grant_type": "authorization_code",
    "code": "abc123",
    "client_id": "oqc_your_client_id",
    "client_secret": "oqs_your_client_secret"
  }'

Field	Required	Description
grant_type	Yes	Must be authorization_code
code	Yes	The authorization code from the callback
client_id	Yes	Your app’s Client ID
client_secret	Yes	Your app’s Client Secret

The redirect URL is validated when the user approves on the consent screen (stored on your OAuth app). Do not send redirect_uri in this request.

Response:

{
  "organizationId": "org_abc123",
  "access_token": "opo_your_access_token",
  "token_type": "bearer"
}

Field	Description
organizationId	The workspace (organization) that was authorized
access_token	The OAuth access token to use for API calls
token_type	Always bearer

Make API calls

Use the returned access_token as a Bearer token in the Authorization header:

curl -H "Authorization: Bearer opo_your_access_token" 
  https://api-production-a424.up.railway.app/api/v1/public/integrations

Part	Required	Description
Authorization header	Yes	Set to your OAuth access_token
URL	Yes	Any public API endpoint under /api/v1/public/*

Managing your app

Rotate client secret

If your client secret is compromised, go to Developers → Apps and click Rotate secret.

This invalidates the old secret immediately — any token exchange requests using the old secret will fail.

Warning

Rotating the secret does not invalidate existing access tokens. Only new token exchange requests require the new secret.

Delete your app

Deleting your OAuth app will:

Revoke all access tokens issued to users
Remove the app from all users’ Approved Apps list
This action cannot be undone