Implementation

Register an OAuth app, run the Authorization Code flow, and manage credentials in the OpenQuok dashboard.

4 min read

Connect your agent today

Draft from chat, review in your calendar, and publish only what you approve.

Start for $0

Register your OAuth app

In the OpenQuok dashboard, go to:

Account → Settings → Developers → Apps

Create an OAuth application and provide:

App name — displayed to users on the consent screen
Description (optional)
Profile picture (optional)
Redirect URL — where OpenQuok sends users after they approve/deny access

After creation you’ll receive:

Client ID — public identifier (prefix oqc_...)
Client secret — secret key for token exchange (prefix oqs_...)

Secret is shown once

Copy the client secret immediately and store it securely. If you lose it, rotate it from the same settings page.

Redirect users to authorize

Redirect the user to:

OPENQUOK_FRONTEND_URL/oauth/authorize?client_id=CLIENT_ID&response_type=code&state=STATE

Parameter	Required	Description
client_id	Yes	Your app’s Client ID (starts with oqc_)
response_type	Yes	Must be code
state	No	A random string to prevent CSRF attacks. Recommended.

OPENQUOK_FRONTEND_URL is the OpenQuok web origin (for example https://www.openquok.com)

Example:

https://www.openquok.com/oauth/authorize?client_id=oqc_your_client_id&response_type=code&state=random123

Example value	What it is
https://www.openquok.com	OpenQuok frontend origin (your OPENQUOK_FRONTEND_URL)
oqc_your_client_id	Your app’s Client ID
code	The only supported response_type
random123	Example state value

The user will see a consent screen showing your app’s name and description. They can choose Authorize or Deny.

Handle the callback

After the user approves, OpenQuok redirects to your Redirect URL.

Approved:

https://yourapp.com/callback?code=abc123&state=random123

Query param	Required	Description
code	Yes	Authorization code (single-use; expires in 10 minutes)
state	No	The same state you sent in the authorize step

Denied:

https://yourapp.com/callback?error=access_denied&state=random123

Query param	Required	Description
error	Yes	access_denied when the user denies the request
state	No	The same state you sent in the authorize step

Verify the state value matches what you sent.

Exchange code for a token

Make a server-side request to exchange the authorization code for an access token.

curl -X POST https://api.openquok.com/api/v1/oauth/token 
  -H "Content-Type: application/json" 
  -d '{
    "grant_type": "authorization_code",
    "code": "abc123",
    "client_id": "oqc_your_client_id",
    "client_secret": "oqs_your_client_secret"
  }'

Field	Required	Description
grant_type	Yes	Must be authorization_code
code	Yes	The authorization code from the callback
client_id	Yes	Your app’s Client ID
client_secret	Yes	Your app’s Client Secret

The redirect URL is validated when the user approves on the consent screen (stored on your OAuth app). Do not send redirect_uri in this request.

Response:

{
  "organizationId": "org_abc123",
  "access_token": "opo_your_access_token",
  "token_type": "bearer"
}

Field	Description
organizationId	The workspace (organization) that was authorized
access_token	The OAuth access token to use for API calls
token_type	Always bearer

Make API calls

Use the returned access_token as a Bearer token in the Authorization header:

curl -H "Authorization: Bearer opo_your_access_token" 
  https://api.openquok.com/api/v1/public/integrations

Part	Required	Description
Authorization header	Yes	Set to your OAuth access_token
URL	Yes	Any public API endpoint under /api/v1/public/*

Managing your app

Rotate client secret

If your client secret is compromised, go to Developers → Apps and click Rotate secret.

This invalidates the old secret immediately — any token exchange requests using the old secret will fail.

Existing access tokens are not invalidated

Rotating the secret does not invalidate existing access tokens. Only new token exchange requests require the new secret.

Delete your app

Deleting your OAuth app will:

Revoke all access tokens issued to users
Remove the app from all users’ Approved Apps list
This action cannot be undone