Build user-delegated integrations with Authorization Code, PKCE, and the RoadOps scope catalog.
RoadOps OAuth apps let a third-party product request user-delegated access to the Developer API. Register an app from OAuth Apps in the account menu, choose the narrowest scopes it needs, and use Authorization Code with PKCE S256.
A confidential server-side application. Authenticate token requests with HTTP Basic using the client ID and client secret.
A scheduling platform whose backend securely stores credentials and calls RoadOps for each connected user.
A public browser application with no client secret.
A browser-based dashboard that exchanges authorization codes with PKCE and calls RoadOps directly with the user's access token.
A public installed application with no client secret. It may use a safe custom callback scheme.
An iOS, Android, or desktop application that returns from RoadOps authorization through an app link or registered custom callback scheme.
The app type is immutable because changing between public and confidential clients changes the security model. Create a replacement app to change types. Each user may own up to five active apps.
Requested OAuth scopes use the exact same catalog as personal access tokens. Effective access is always the intersection of the access token scopes and the authorizing user's current RoadOps team membership, permissions, visibility, and resource ownership rules.
When a read scope depends on a parent resource, RoadOps automatically includes the required parent read scopes. For example, schedule_item:read includes day:read and team:read, while set_list:read includes event:read, day:read, and team:read.
RoadOps creates secure third-party OAuth applications. Consent is mandatory.
The scopes saved on an OAuth app define the maximum access it may request. The app must still include every desired scope in the scope parameter of its authorization request. Adding a scope in the Developer Portal does not change existing access tokens or the authorization URL in your code. Update the authorization request and start a new authorization flow so the user can approve the additional access. A refresh token cannot be used to add scopes that were not granted during the original authorization.
Third-party clients currently support RoadOps API authorization only. Do not request openid, profile, or email. To retrieve the authenticated user's basic RoadOps identity, call Get the current user. This route does not require a permission scope.