OAuth applications
Let your service act for people who authorize it, or as an agent of its own.
Create an application in Settings › API to get a client ID and secret, then set its redirect URIs and scopes.
- For people: OAuth 2.0 authorization code flow with PKCE.
- As an agent:
actor=app, with theapp:assignableandapp:mentionablescopes, so it can be delegated issues and mentioned. - Refresh tokens: short-lived access tokens with a refresh token.
client_credentials: a token for the application itself.
Revoke a token with POST https://app.linefold.app/oauth/revoke.