OAuth apps

EveryChan is its own OAuth 2.0 authorization server. Register an app once, and any workspace can install it and grant it scoped access — the same model Slack or HubSpot use for their marketplaces.

1. Register your app

In the app, go to Settings → Developers and create a developer app. You provide a name, one or more redirect URIs, and the scopes you need. You receive a client_id and a client_secret — the secret is shown once, so store it securely.

2. Send the workspace to authorize

Redirect the installing user to the authorize endpoint:

GET /api/oauth/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https://your-app.com/oauth/callback
  &scope=chats:read chats:write
  &state=RANDOM_STRING

They review the requested scopes and pick a workspace to install into. On approval, EveryChan redirects back to your redirect_uri with a short-lived code.

3. Exchange the code for tokens

POST /api/oauth/token
Content-Type: application/json

{
  "grant_type": "authorization_code",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "code": "THE_CODE",
  "redirect_uri": "https://your-app.com/oauth/callback"
}

# → { "access_token": "…", "refresh_token": "…", "expires_in": … }

The access token is scoped to the workspace that installed your app. Use it as a bearer token. When it expires, exchange the refresh token with grant_type=refresh_token.

Revocation

Admins see installed apps under Settings → Developers → Installed integrations and can revoke access at any time, which invalidates the tokens immediately.