OAuth apps

Use OAuth when your product schedules posts for other QPosty users. Do not ask them for their API key.

1. Register the app

Settings → Developers → Apps → create app with redirect URL.

Credentials:

• Client ID: pca_…
• Client Secret: pcs_… (once)

2. Redirect users to authorize

https://app.qposty.com/oauth/authorize?client_id=pca_YOUR_ID&response_type=code&state=RANDOM

Param	Required	Notes
client_id	Yes	Your pca_ id
response_type	Yes	Must be code
state	Recommended	CSRF protection

Consent screen shows your name, description, and picture.

3. Handle the callback

Success:

https://yourapp.com/callback?code=…&state=…

Denied:

https://yourapp.com/callback?error=access_denied&state=…

Codes expire in 10 minutes and are single-use.

4. Exchange the code

curl -X POST https://api.qposty.com/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "…",
    "client_id": "pca_…",
    "client_secret": "pcs_…"
  }'

{
  "id": "org_id",
  "cus": null,
  "access_token": "pos_…",
  "token_type": "bearer"
}

5. Call the Public API

Use access_token exactly like an API key on /public/v1/*.

Managing the app

Action	Effect
Rotate secret	Old pcs_ fails on new exchanges; existing pos_ tokens keep working
Delete app	All pos_ tokens revoked; removed from users' Approved apps
User Revoke	That org's tokens for your app stop working

Errors

Error	When
invalid_client	Bad client id/secret
invalid_grant	Code invalid, expired, or reused
unsupported_grant_type	grant_type ≠ authorization_code
access_denied	User clicked Deny