RoadOpsDeveloper
Getting StartedOAuth AppsAuthorization CodeRefresh TokensProduction ReadinessOperationsCurrent UserTeamsMembersTravel PartiesDaysDay NotesSchedule ItemsEventsVenuesGuest RequestsPass TypesTicket TypesSet ListsSet List ItemsLodgingRental CarsDay FilesMCP ServerPostman Collection

Production Readiness

Validate redirects, protect credentials, and recover safely from OAuth failures.

Redirect validation

Hosted callback URLs and origins must use HTTPS. For local development, HTTP is allowed only on localhost, 127.0.0.1, and IPv6 [::1], with an optional port. Callback URLs may include a path; origins must contain only the scheme, host, and optional port. Native apps may use safe custom schemes. Wildcards, URL credentials, fragments, duplicate URLs, and unsafe schemes are rejected. Register the smallest exact set of callbacks and origins.

Production checklist

  • Use PKCE S256 and validate a one-time state value.
  • Keep regular-web client secrets and refresh tokens in encrypted server-side storage.
  • Do not embed secrets in SPAs, native apps, repositories, logs, analytics, or error reports.
  • Request only required scopes and handle consent denial.
  • Refresh before access-token expiry, atomically store the replacement refresh token, and fall back to reauthorization.
  • Treat invalid_grant as a signal to discard the authorization code or refresh token; do not retry it indefinitely.
  • Treat API 401 as an invalid, expired, or disabled credential and 403 as insufficient OAuth scope or current RoadOps permission.