{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["img"]},"type":"markdown"},"seo":{"title":"OAuth Clients"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"oauth-clients","__idx":0},"children":["OAuth Clients"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["OAuth clients let third-party applications access an iClosed workspace on behalf of a user — without sharing that user's API key. This guide covers how to register a client in the iClosed app, what to choose during setup, how the authorization flow works, how tokens are issued, and how client approval affects who can connect."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For endpoint-level request and response schemas, see the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://developer.iclosed.io/openapi/v1/oauth"},"children":["OAuth API Reference"]},"."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Detail"},"children":["Detail"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Protocol"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OAuth 2.0 (authorization code + refresh token)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User consent URL"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://app.iclosed.io/oauth/authorize"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Token endpoint"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST https://public.api.iclosed.io/v1/oauth/token"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client ID format"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ocl_…"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Access token lifetime"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["1 hour"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Refresh token lifetime"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["30 days (rotated on each refresh)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["PKCE"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["public"]}," clients; optional for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["confidential"]}," clients"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["OAuth access tokens use the same scope model as API keys (for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["contacts:read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deals:write"]},"). Each API request made with an OAuth access token runs in the context of the workspace the user authorized."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"where-to-find-oauth-clients","__idx":2},"children":["Where to find OAuth Clients"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["OAuth clients are managed from the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Developer"]}," area in your iClosed account settings — the same place as Webhooks and API Keys."]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Log in at ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://app.iclosed.io"},"children":["app.iclosed.io"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Open ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Developer"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In the left sidebar, click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OAuth Clients"]},"."]}]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/oauth-clients-empty-state.4e92a9845f2574a568e76e20adc6076737506ec5123a63464d69f69ece041ed1.9c1bb791.png","alt":"OAuth Clients page in Settings → Developer with an empty state and a Register client button.","framed":false,"withLightbox":false},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["From this page you can:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Register client"]}," — create a new OAuth application."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["View registered clients, their scopes, and approval status."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Edit or delete clients you own (via the row menu)."]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["OAuth clients are available on every iClosed plan, and a workspace can register up to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["20"]}," clients. If you do not see the Developer section, your role does not include access to it. Ask a Super Admin."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"register-an-oauth-client","__idx":3},"children":["Register an OAuth client"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Register client"]}," to open the registration form."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"app-details","__idx":4},"children":["App details"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/oauth-clients-register-form-details.d150d7ecc6e8fd3935a4c877c9d13d8a97f423bae19b814e6d25aabfaa2df139.9c1bb791.png","alt":"Register OAuth client form showing name, homepage URL, logo upload, redirect URIs, and grant types.","framed":false,"withLightbox":false},"children":[]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Required"},"children":["Required"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What to enter"},"children":["What to enter"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Name"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Display name shown on the consent screen (for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Get Cast"]},")."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["App Homepage URL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["No"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Link to your app's website. Shown on the consent screen so users know who is requesting access."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Logo"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["No"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Square image (JPG, PNG, WebP, or SVG; max 2 MB, 512×512 px). Shown on the consent screen."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Redirect URIs"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["One or more callback URLs. Must be ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["exact"]}," HTTPS URLs (or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["http://localhost"]}," for local development). Add multiple URIs with ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add redirect URI"]}," if you have staging and production environments."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Redirect URI tips:"]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The URI you send in the authorize request must match one of the registered URIs ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["character for character"]}," (including trailing slashes)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use HTTPS in production. Localhost is allowed for development only."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"grant-types","__idx":5},"children":["Grant types"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Both grant types are typically enabled:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Grant type"},"children":["Grant type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authorization code"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Standard browser-based OAuth flow. Users sign in and approve access; your app receives a short-lived code to exchange for tokens."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Refresh token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lets your app obtain new access tokens without asking the user to sign in again."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"allowed-scopes","__idx":6},"children":["Allowed scopes"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/oauth-clients-register-form-scopes.11192e1686c1eddfb5b92ca13773333076f17545ba424c75a05cb63e0f73851e.9c1bb791.png","alt":"Register OAuth client form showing grant types, allowed scopes chips, and public vs confidential client type.","framed":false,"withLightbox":false},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Scopes define the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["maximum"]}," permissions your app can request. When a user authorizes your app, they grant a subset of these scopes."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Add scopes from the suggestion chips, or type a scope and press Enter."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Only request scopes your integration actually needs — users see grouped permissions on the consent screen."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Scope names follow the same pattern as API keys (for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["contacts:read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["contacts:write"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deals:read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["events:write"]},")."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://developer.iclosed.io/openapi/v1/openapi"},"children":["API Reference"]}," for the full list of available scopes on each endpoint."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"client-type","__idx":7},"children":["Client type"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Choose the client type based on where your app runs:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Type"},"children":["Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"When to use"},"children":["When to use"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Secret"},"children":["Secret"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"PKCE"},"children":["PKCE"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Public"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Browser apps, mobile apps, SPAs — anything that ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["cannot"]}," store a secret securely"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["No client secret is issued"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Required"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Confidential"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Server-side apps that can store credentials in a vault or environment variable"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A client secret is generated ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["once"]}," at registration — save it immediately"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional (still supported)"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Choose Public if"]}," your code runs entirely in the user's browser or on a device you do not fully control."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Choose Confidential if"]}," token exchange happens on your backend and you can store ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_secret"]}," securely."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Register client"]}," when the form is complete."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"after-registration","__idx":8},"children":["After registration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On success, iClosed shows your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]}," and next-step guidance."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/oauth-clients-register-success.33cb9ab2889a982fc1186980a76c9a2adab7f78d2e94a368a78d8b9ddbffbc6e.9c1bb791.png","alt":"Client registered success dialog showing Client ID, pending approval notice, and PKCE instructions for public clients.","framed":false,"withLightbox":false},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save your Client ID"]}," — you need it to start the OAuth flow. If you registered a confidential client, also copy the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["client secret"]}," now; it is shown only once."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"pending-approval-important","__idx":9},"children":["Pending approval (important)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["New clients registered through the Developer portal start in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Pending approval"]}," status."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["While pending:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Only users in the workspace that registered the client"]}," can complete the OAuth flow and connect the app."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Users in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["other"]}," iClosed accounts cannot authorize the app — they will see an access-denied message on the consent screen or receive a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["403 access_denied"]}," error."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This lets you build and test safely before the app is available to all iClosed customers."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["To make your app available to users in any iClosed account"]},", contact ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://app.iclosed.io/support"},"children":["iClosed Support"]}," and request approval for your OAuth client. After iClosed approves the client (status moves to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Approved"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Active"]},"), any authenticated iClosed user can authorize it for their workspace."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/oauth-clients-list.a2183cbc9a58727ad412696ae7145fe295c8b8aa87b7a497ef77c8948630a6c5.9c1bb791.png","alt":"OAuth client list showing a pending client with dev/testing restriction message.","framed":false,"withLightbox":false},"children":[]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Status"},"children":["Status"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Who can authorize"},"children":["Who can authorize"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Pending"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Users in the registering workspace only"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Approved"]}," / ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Active"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Any iClosed user (subject to consent)"]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-the-oauth-flow-works","__idx":10},"children":["How the OAuth flow works"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The iClosed OAuth flow follows the standard ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["authorization code"]}," pattern with optional PKCE."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n    participant App as Your app\n    participant Browser as User browser\n    participant Consent as app.iclosed.io/oauth/authorize\n    participant API as public.api.iclosed.io\n\n    App->>Browser: Redirect to consent URL with client_id, redirect_uri, scope, PKCE challenge\n    Browser->>Consent: User opens authorize link\n    Consent->>Browser: Login (if needed) + consent screen\n    Browser->>Consent: User clicks Allow access\n    Consent->>API: GET /v1/oauth/authorize (session JWT)\n    API->>Browser: Redirect to redirect_uri?code=...&state=...\n    Browser->>App: Callback with authorization code\n    App->>API: POST /v1/oauth/token (code + code_verifier)\n    API->>App: access_token, refresh_token, expires_in, scope\n    App->>API: API calls with Authorization Bearer access_token\n","diagramHtml":"<svg id=\"diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9\" width=\"100%\" xmlns=\"http://www.w3.org/2000/svg\" style=\"max-width: 1527.5px;\" viewBox=\"-50 -10 1527.5 627\" role=\"graphics-document document\" aria-roledescription=\"sequence\"><style>\n    #diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 foreignObject {\n      overflow: visible;\n    }\n  </style><g><rect x=\"1268.5\" y=\"541\" fill=\"#eaeaea\" stroke=\"#666\" width=\"159\" height=\"65\" name=\"API\" rx=\"3\" ry=\"3\" class=\"actor actor-bottom\"></rect><text x=\"1348\" y=\"573.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"1348\" dy=\"0\">public.api.iclosed.io</tspan></text></g><g><rect x=\"881.5\" y=\"541\" fill=\"#eaeaea\" stroke=\"#666\" width=\"233\" height=\"65\" name=\"Consent\" rx=\"3\" ry=\"3\" class=\"actor actor-bottom\"></rect><text x=\"998\" y=\"573.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"998\" dy=\"0\">app.iclosed.io/oauth/authorize</tspan></text></g><g><rect x=\"606\" y=\"541\" fill=\"#eaeaea\" stroke=\"#666\" width=\"150\" height=\"65\" name=\"Browser\" rx=\"3\" ry=\"3\" class=\"actor actor-bottom\"></rect><text x=\"681\" y=\"573.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"681\" dy=\"0\">User browser</tspan></text></g><g><rect x=\"0\" y=\"541\" fill=\"#eaeaea\" stroke=\"#666\" width=\"150\" height=\"65\" name=\"App\" rx=\"3\" ry=\"3\" class=\"actor actor-bottom\"></rect><text x=\"75\" y=\"573.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"75\" dy=\"0\">Your app</tspan></text></g><g><line id=\"actor3\" x1=\"1348\" y1=\"65\" x2=\"1348\" y2=\"541\" class=\"actor-line 200\" stroke-width=\"0.5px\" stroke=\"#999\" name=\"API\" data-et=\"life-line\" data-id=\"API\"></line><g id=\"root-3\" data-et=\"participant\" data-type=\"participant\" data-id=\"API\"><rect x=\"1268.5\" y=\"0\" fill=\"#eaeaea\" stroke=\"#666\" width=\"159\" height=\"65\" name=\"API\" rx=\"3\" ry=\"3\" class=\"actor actor-top\"></rect><text x=\"1348\" y=\"32.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"1348\" dy=\"0\">public.api.iclosed.io</tspan></text></g></g><g><line id=\"actor2\" x1=\"998\" y1=\"65\" x2=\"998\" y2=\"541\" class=\"actor-line 200\" stroke-width=\"0.5px\" stroke=\"#999\" name=\"Consent\" data-et=\"life-line\" data-id=\"Consent\"></line><g id=\"root-2\" data-et=\"participant\" data-type=\"participant\" data-id=\"Consent\"><rect x=\"881.5\" y=\"0\" fill=\"#eaeaea\" stroke=\"#666\" width=\"233\" height=\"65\" name=\"Consent\" rx=\"3\" ry=\"3\" class=\"actor actor-top\"></rect><text x=\"998\" y=\"32.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"998\" dy=\"0\">app.iclosed.io/oauth/authorize</tspan></text></g></g><g><line id=\"actor1\" x1=\"681\" y1=\"65\" x2=\"681\" y2=\"541\" class=\"actor-line 200\" stroke-width=\"0.5px\" stroke=\"#999\" name=\"Browser\" data-et=\"life-line\" data-id=\"Browser\"></line><g id=\"root-1\" data-et=\"participant\" data-type=\"participant\" data-id=\"Browser\"><rect x=\"606\" y=\"0\" fill=\"#eaeaea\" stroke=\"#666\" width=\"150\" height=\"65\" name=\"Browser\" rx=\"3\" ry=\"3\" class=\"actor actor-top\"></rect><text x=\"681\" y=\"32.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"681\" dy=\"0\">User browser</tspan></text></g></g><g><line id=\"actor0\" x1=\"75\" y1=\"65\" x2=\"75\" y2=\"541\" class=\"actor-line 200\" stroke-width=\"0.5px\" stroke=\"#999\" name=\"App\" data-et=\"life-line\" data-id=\"App\"></line><g id=\"root-0\" data-et=\"participant\" data-type=\"participant\" data-id=\"App\"><rect x=\"0\" y=\"0\" fill=\"#eaeaea\" stroke=\"#666\" width=\"150\" height=\"65\" name=\"App\" rx=\"3\" ry=\"3\" class=\"actor actor-top\"></rect><text x=\"75\" y=\"32.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"75\" dy=\"0\">Your app</tspan></text></g></g><style>#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9{font-family:\"Redocly Mermaid Sans\",Arial,\"Liberation Sans\",Arimo,Helvetica,\"Redocly Mermaid CJK\",sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .error-icon{fill:#552222;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .error-text{fill:#552222;stroke:#552222;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .edge-thickness-normal{stroke-width:1px;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .edge-thickness-thick{stroke-width:3.5px;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .edge-pattern-solid{stroke-dasharray:0;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .edge-thickness-invisible{stroke-width:0;fill:none;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .edge-pattern-dashed{stroke-dasharray:3;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .edge-pattern-dotted{stroke-dasharray:2;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .marker{fill:#333333;stroke:#333333;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .marker.cross{stroke:#333333;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 svg{font-family:\"Redocly Mermaid Sans\",Arial,\"Liberation Sans\",Arimo,Helvetica,\"Redocly Mermaid CJK\",sans-serif;font-size:16px;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 p{margin:0;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .actor{stroke:#9370DB;fill:#ECECFF;stroke-width:1;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 rect.actor.outer-path[data-look=\"neo\"]{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 rect.note[data-look=\"neo\"]{stroke:#aaaa33;fill:#fff5ad;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 text.actor&gt;tspan{fill:black;stroke:none;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .actor-line{stroke:#9370DB;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .innerArc{stroke-width:1.5;stroke-dasharray:none;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [id$=\"-arrowhead\"] path{fill:#333;stroke:#333;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .sequenceNumber{fill:white;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [id$=\"-sequencenumber\"]{fill:#333;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [id$=\"-crosshead\"] path{fill:#333;stroke:#333;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .messageText{fill:#333;stroke:none;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .labelBox{stroke:#9370DB;fill:#ECECFF;filter:none;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .labelText,#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .labelText&gt;tspan{fill:black;stroke:none;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .loopText,#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .loopText&gt;tspan{fill:black;stroke:none;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .sectionTitle,#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .sectionTitle&gt;tspan{fill:black;stroke:none;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:#9370DB;fill:#9370DB;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .note{stroke:#aaaa33;fill:#fff5ad;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .noteText,#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .noteText&gt;tspan{fill:black;stroke:none;font-weight:normal;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .activation0{fill:#f4f4f4;stroke:#666;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .activation1{fill:#f4f4f4;stroke:#666;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .activation2{fill:#f4f4f4;stroke:#666;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .actorPopupMenu{position:absolute;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .actor-man circle,#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 line{fill:#ECECFF;stroke-width:2px;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 g rect.rect{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));stroke:#9370DB;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 .node .neo-node{stroke:#9370DB;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [data-look=\"neo\"].node rect,#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [data-look=\"neo\"].cluster rect,#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [data-look=\"neo\"].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [data-look=\"neo\"].swimlane.cluster rect{filter:none;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [data-look=\"neo\"].node path{stroke:#9370DB;stroke-width:1px;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [data-look=\"neo\"].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [data-look=\"neo\"].node .neo-line path{stroke:#9370DB;filter:none;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [data-look=\"neo\"].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [data-look=\"neo\"].node circle .state-start{fill:#000000;}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [data-look=\"neo\"].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 [data-look=\"neo\"].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9 :root{--mermaid-font-family:\"Redocly Mermaid Sans\",Arial,\"Liberation Sans\",Arimo,Helvetica,\"Redocly Mermaid CJK\",sans-serif;}</style><g></g><defs><symbol id=\"diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-computer\" width=\"24\" height=\"24\"><path transform=\"scale(.5)\" d=\"M2 2v13h20v-13h-20zm18 11h-16v-9h16v9zm-10.228 6l.466-1h3.524l.467 1h-4.457zm14.228 3h-24l2-6h2.104l-1.33 4h18.45l-1.297-4h2.073l2 6zm-5-10h-14v-7h14v7z\"></path></symbol></defs><defs><symbol id=\"diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-database\" fill-rule=\"evenodd\" clip-rule=\"evenodd\"><path transform=\"scale(.5)\" d=\"M12.258.001l.256.004.255.005.253.008.251.01.249.012.247.015.246.016.242.019.241.02.239.023.236.024.233.027.231.028.229.031.225.032.223.034.22.036.217.038.214.04.211.041.208.043.205.045.201.046.198.048.194.05.191.051.187.053.183.054.18.056.175.057.172.059.168.06.163.061.16.063.155.064.15.066.074.033.073.033.071.034.07.034.069.035.068.035.067.035.066.035.064.036.064.036.062.036.06.036.06.037.058.037.058.037.055.038.055.038.053.038.052.038.051.039.05.039.048.039.047.039.045.04.044.04.043.04.041.04.04.041.039.041.037.041.036.041.034.041.033.042.032.042.03.042.029.042.027.042.026.043.024.043.023.043.021.043.02.043.018.044.017.043.015.044.013.044.012.044.011.045.009.044.007.045.006.045.004.045.002.045.001.045v17l-.001.045-.002.045-.004.045-.006.045-.007.045-.009.044-.011.045-.012.044-.013.044-.015.044-.017.043-.018.044-.02.043-.021.043-.023.043-.024.043-.026.043-.027.042-.029.042-.03.042-.032.042-.033.042-.034.041-.036.041-.037.041-.039.041-.04.041-.041.04-.043.04-.044.04-.045.04-.047.039-.048.039-.05.039-.051.039-.052.038-.053.038-.055.038-.055.038-.058.037-.058.037-.06.037-.06.036-.062.036-.064.036-.064.036-.066.035-.067.035-.068.035-.069.035-.07.034-.071.034-.073.033-.074.033-.15.066-.155.064-.16.063-.163.061-.168.06-.172.059-.175.057-.18.056-.183.054-.187.053-.191.051-.194.05-.198.048-.201.046-.205.045-.208.043-.211.041-.214.04-.217.038-.22.036-.223.034-.225.032-.229.031-.231.028-.233.027-.236.024-.239.023-.241.02-.242.019-.246.016-.247.015-.249.012-.251.01-.253.008-.255.005-.256.004-.258.001-.258-.001-.256-.004-.255-.005-.253-.008-.251-.01-.249-.012-.247-.015-.245-.016-.243-.019-.241-.02-.238-.023-.236-.024-.234-.027-.231-.028-.228-.031-.226-.032-.223-.034-.22-.036-.217-.038-.214-.04-.211-.041-.208-.043-.204-.045-.201-.046-.198-.048-.195-.05-.19-.051-.187-.053-.184-.054-.179-.056-.176-.057-.172-.059-.167-.06-.164-.061-.159-.063-.155-.064-.151-.066-.074-.033-.072-.033-.072-.034-.07-.034-.069-.035-.068-.035-.067-.035-.066-.035-.064-.036-.063-.036-.062-.036-.061-.036-.06-.037-.058-.037-.057-.037-.056-.038-.055-.038-.053-.038-.052-.038-.051-.039-.049-.039-.049-.039-.046-.039-.046-.04-.044-.04-.043-.04-.041-.04-.04-.041-.039-.041-.037-.041-.036-.041-.034-.041-.033-.042-.032-.042-.03-.042-.029-.042-.027-.042-.026-.043-.024-.043-.023-.043-.021-.043-.02-.043-.018-.044-.017-.043-.015-.044-.013-.044-.012-.044-.011-.045-.009-.044-.007-.045-.006-.045-.004-.045-.002-.045-.001-.045v-17l.001-.045.002-.045.004-.045.006-.045.007-.045.009-.044.011-.045.012-.044.013-.044.015-.044.017-.043.018-.044.02-.043.021-.043.023-.043.024-.043.026-.043.027-.042.029-.042.03-.042.032-.042.033-.042.034-.041.036-.041.037-.041.039-.041.04-.041.041-.04.043-.04.044-.04.046-.04.046-.039.049-.039.049-.039.051-.039.052-.038.053-.038.055-.038.056-.038.057-.037.058-.037.06-.037.061-.036.062-.036.063-.036.064-.036.066-.035.067-.035.068-.035.069-.035.07-.034.072-.034.072-.033.074-.033.151-.066.155-.064.159-.063.164-.061.167-.06.172-.059.176-.057.179-.056.184-.054.187-.053.19-.051.195-.05.198-.048.201-.046.204-.045.208-.043.211-.041.214-.04.217-.038.22-.036.223-.034.226-.032.228-.031.231-.028.234-.027.236-.024.238-.023.241-.02.243-.019.245-.016.247-.015.249-.012.251-.01.253-.008.255-.005.256-.004.258-.001.258.001zm-9.258 20.499v.01l.001.021.003.021.004.022.005.021.006.022.007.022.009.023.01.022.011.023.012.023.013.023.015.023.016.024.017.023.018.024.019.024.021.024.022.025.023.024.024.025.052.049.056.05.061.051.066.051.07.051.075.051.079.052.084.052.088.052.092.052.097.052.102.051.105.052.11.052.114.051.119.051.123.051.127.05.131.05.135.05.139.048.144.049.147.047.152.047.155.047.16.045.163.045.167.043.171.043.176.041.178.041.183.039.187.039.19.037.194.035.197.035.202.033.204.031.209.03.212.029.216.027.219.025.222.024.226.021.23.02.233.018.236.016.24.015.243.012.246.01.249.008.253.005.256.004.259.001.26-.001.257-.004.254-.005.25-.008.247-.011.244-.012.241-.014.237-.016.233-.018.231-.021.226-.021.224-.024.22-.026.216-.027.212-.028.21-.031.205-.031.202-.034.198-.034.194-.036.191-.037.187-.039.183-.04.179-.04.175-.042.172-.043.168-.044.163-.045.16-.046.155-.046.152-.047.148-.048.143-.049.139-.049.136-.05.131-.05.126-.05.123-.051.118-.052.114-.051.11-.052.106-.052.101-.052.096-.052.092-.052.088-.053.083-.051.079-.052.074-.052.07-.051.065-.051.06-.051.056-.05.051-.05.023-.024.023-.025.021-.024.02-.024.019-.024.018-.024.017-.024.015-.023.014-.024.013-.023.012-.023.01-.023.01-.022.008-.022.006-.022.006-.022.004-.022.004-.021.001-.021.001-.021v-4.127l-.077.055-.08.053-.083.054-.085.053-.087.052-.09.052-.093.051-.095.05-.097.05-.1.049-.102.049-.105.048-.106.047-.109.047-.111.046-.114.045-.115.045-.118.044-.12.043-.122.042-.124.042-.126.041-.128.04-.13.04-.132.038-.134.038-.135.037-.138.037-.139.035-.142.035-.143.034-.144.033-.147.032-.148.031-.15.03-.151.03-.153.029-.154.027-.156.027-.158.026-.159.025-.161.024-.162.023-.163.022-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.011-.178.01-.179.008-.179.008-.181.006-.182.005-.182.004-.184.003-.184.002h-.37l-.184-.002-.184-.003-.182-.004-.182-.005-.181-.006-.179-.008-.179-.008-.178-.01-.176-.011-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.022-.162-.023-.161-.024-.159-.025-.157-.026-.156-.027-.155-.027-.153-.029-.151-.03-.15-.03-.148-.031-.146-.032-.145-.033-.143-.034-.141-.035-.14-.035-.137-.037-.136-.037-.134-.038-.132-.038-.13-.04-.128-.04-.126-.041-.124-.042-.122-.042-.12-.044-.117-.043-.116-.045-.113-.045-.112-.046-.109-.047-.106-.047-.105-.048-.102-.049-.1-.049-.097-.05-.095-.05-.093-.052-.09-.051-.087-.052-.085-.053-.083-.054-.08-.054-.077-.054v4.127zm0-5.654v.011l.001.021.003.021.004.021.005.022.006.022.007.022.009.022.01.022.011.023.012.023.013.023.015.024.016.023.017.024.018.024.019.024.021.024.022.024.023.025.024.024.052.05.056.05.061.05.066.051.07.051.075.052.079.051.084.052.088.052.092.052.097.052.102.052.105.052.11.051.114.051.119.052.123.05.127.051.131.05.135.049.139.049.144.048.147.048.152.047.155.046.16.045.163.045.167.044.171.042.176.042.178.04.183.04.187.038.19.037.194.036.197.034.202.033.204.032.209.03.212.028.216.027.219.025.222.024.226.022.23.02.233.018.236.016.24.014.243.012.246.01.249.008.253.006.256.003.259.001.26-.001.257-.003.254-.006.25-.008.247-.01.244-.012.241-.015.237-.016.233-.018.231-.02.226-.022.224-.024.22-.025.216-.027.212-.029.21-.03.205-.032.202-.033.198-.035.194-.036.191-.037.187-.039.183-.039.179-.041.175-.042.172-.043.168-.044.163-.045.16-.045.155-.047.152-.047.148-.048.143-.048.139-.05.136-.049.131-.05.126-.051.123-.051.118-.051.114-.052.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.051.07-.052.065-.051.06-.05.056-.051.051-.049.023-.025.023-.024.021-.025.02-.024.019-.024.018-.024.017-.024.015-.023.014-.023.013-.024.012-.022.01-.023.01-.023.008-.022.006-.022.006-.022.004-.021.004-.022.001-.021.001-.021v-4.139l-.077.054-.08.054-.083.054-.085.052-.087.053-.09.051-.093.051-.095.051-.097.05-.1.049-.102.049-.105.048-.106.047-.109.047-.111.046-.114.045-.115.044-.118.044-.12.044-.122.042-.124.042-.126.041-.128.04-.13.039-.132.039-.134.038-.135.037-.138.036-.139.036-.142.035-.143.033-.144.033-.147.033-.148.031-.15.03-.151.03-.153.028-.154.028-.156.027-.158.026-.159.025-.161.024-.162.023-.163.022-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.011-.178.009-.179.009-.179.007-.181.007-.182.005-.182.004-.184.003-.184.002h-.37l-.184-.002-.184-.003-.182-.004-.182-.005-.181-.007-.179-.007-.179-.009-.178-.009-.176-.011-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.022-.162-.023-.161-.024-.159-.025-.157-.026-.156-.027-.155-.028-.153-.028-.151-.03-.15-.03-.148-.031-.146-.033-.145-.033-.143-.033-.141-.035-.14-.036-.137-.036-.136-.037-.134-.038-.132-.039-.13-.039-.128-.04-.126-.041-.124-.042-.122-.043-.12-.043-.117-.044-.116-.044-.113-.046-.112-.046-.109-.046-.106-.047-.105-.048-.102-.049-.1-.049-.097-.05-.095-.051-.093-.051-.09-.051-.087-.053-.085-.052-.083-.054-.08-.054-.077-.054v4.139zm0-5.666v.011l.001.02.003.022.004.021.005.022.006.021.007.022.009.023.01.022.011.023.012.023.013.023.015.023.016.024.017.024.018.023.019.024.021.025.022.024.023.024.024.025.052.05.056.05.061.05.066.051.07.051.075.052.079.051.084.052.088.052.092.052.097.052.102.052.105.051.11.052.114.051.119.051.123.051.127.05.131.05.135.05.139.049.144.048.147.048.152.047.155.046.16.045.163.045.167.043.171.043.176.042.178.04.183.04.187.038.19.037.194.036.197.034.202.033.204.032.209.03.212.028.216.027.219.025.222.024.226.021.23.02.233.018.236.017.24.014.243.012.246.01.249.008.253.006.256.003.259.001.26-.001.257-.003.254-.006.25-.008.247-.01.244-.013.241-.014.237-.016.233-.018.231-.02.226-.022.224-.024.22-.025.216-.027.212-.029.21-.03.205-.032.202-.033.198-.035.194-.036.191-.037.187-.039.183-.039.179-.041.175-.042.172-.043.168-.044.163-.045.16-.045.155-.047.152-.047.148-.048.143-.049.139-.049.136-.049.131-.051.126-.05.123-.051.118-.052.114-.051.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.052.07-.051.065-.051.06-.051.056-.05.051-.049.023-.025.023-.025.021-.024.02-.024.019-.024.018-.024.017-.024.015-.023.014-.024.013-.023.012-.023.01-.022.01-.023.008-.022.006-.022.006-.022.004-.022.004-.021.001-.021.001-.021v-4.153l-.077.054-.08.054-.083.053-.085.053-.087.053-.09.051-.093.051-.095.051-.097.05-.1.049-.102.048-.105.048-.106.048-.109.046-.111.046-.114.046-.115.044-.118.044-.12.043-.122.043-.124.042-.126.041-.128.04-.13.039-.132.039-.134.038-.135.037-.138.036-.139.036-.142.034-.143.034-.144.033-.147.032-.148.032-.15.03-.151.03-.153.028-.154.028-.156.027-.158.026-.159.024-.161.024-.162.023-.163.023-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.01-.178.01-.179.009-.179.007-.181.006-.182.006-.182.004-.184.003-.184.001-.185.001-.185-.001-.184-.001-.184-.003-.182-.004-.182-.006-.181-.006-.179-.007-.179-.009-.178-.01-.176-.01-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.023-.162-.023-.161-.024-.159-.024-.157-.026-.156-.027-.155-.028-.153-.028-.151-.03-.15-.03-.148-.032-.146-.032-.145-.033-.143-.034-.141-.034-.14-.036-.137-.036-.136-.037-.134-.038-.132-.039-.13-.039-.128-.041-.126-.041-.124-.041-.122-.043-.12-.043-.117-.044-.116-.044-.113-.046-.112-.046-.109-.046-.106-.048-.105-.048-.102-.048-.1-.05-.097-.049-.095-.051-.093-.051-.09-.052-.087-.052-.085-.053-.083-.053-.08-.054-.077-.054v4.153zm8.74-8.179l-.257.004-.254.005-.25.008-.247.011-.244.012-.241.014-.237.016-.233.018-.231.021-.226.022-.224.023-.22.026-.216.027-.212.028-.21.031-.205.032-.202.033-.198.034-.194.036-.191.038-.187.038-.183.04-.179.041-.175.042-.172.043-.168.043-.163.045-.16.046-.155.046-.152.048-.148.048-.143.048-.139.049-.136.05-.131.05-.126.051-.123.051-.118.051-.114.052-.11.052-.106.052-.101.052-.096.052-.092.052-.088.052-.083.052-.079.052-.074.051-.07.052-.065.051-.06.05-.056.05-.051.05-.023.025-.023.024-.021.024-.02.025-.019.024-.018.024-.017.023-.015.024-.014.023-.013.023-.012.023-.01.023-.01.022-.008.022-.006.023-.006.021-.004.022-.004.021-.001.021-.001.021.001.021.001.021.004.021.004.022.006.021.006.023.008.022.01.022.01.023.012.023.013.023.014.023.015.024.017.023.018.024.019.024.02.025.021.024.023.024.023.025.051.05.056.05.06.05.065.051.07.052.074.051.079.052.083.052.088.052.092.052.096.052.101.052.106.052.11.052.114.052.118.051.123.051.126.051.131.05.136.05.139.049.143.048.148.048.152.048.155.046.16.046.163.045.168.043.172.043.175.042.179.041.183.04.187.038.191.038.194.036.198.034.202.033.205.032.21.031.212.028.216.027.22.026.224.023.226.022.231.021.233.018.237.016.241.014.244.012.247.011.25.008.254.005.257.004.26.001.26-.001.257-.004.254-.005.25-.008.247-.011.244-.012.241-.014.237-.016.233-.018.231-.021.226-.022.224-.023.22-.026.216-.027.212-.028.21-.031.205-.032.202-.033.198-.034.194-.036.191-.038.187-.038.183-.04.179-.041.175-.042.172-.043.168-.043.163-.045.16-.046.155-.046.152-.048.148-.048.143-.048.139-.049.136-.05.131-.05.126-.051.123-.051.118-.051.114-.052.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.051.07-.052.065-.051.06-.05.056-.05.051-.05.023-.025.023-.024.021-.024.02-.025.019-.024.018-.024.017-.023.015-.024.014-.023.013-.023.012-.023.01-.023.01-.022.008-.022.006-.023.006-.021.004-.022.004-.021.001-.021.001-.021-.001-.021-.001-.021-.004-.021-.004-.022-.006-.021-.006-.023-.008-.022-.01-.022-.01-.023-.012-.023-.013-.023-.014-.023-.015-.024-.017-.023-.018-.024-.019-.024-.02-.025-.021-.024-.023-.024-.023-.025-.051-.05-.056-.05-.06-.05-.065-.051-.07-.052-.074-.051-.079-.052-.083-.052-.088-.052-.092-.052-.096-.052-.101-.052-.106-.052-.11-.052-.114-.052-.118-.051-.123-.051-.126-.051-.131-.05-.136-.05-.139-.049-.143-.048-.148-.048-.152-.048-.155-.046-.16-.046-.163-.045-.168-.043-.172-.043-.175-.042-.179-.041-.183-.04-.187-.038-.191-.038-.194-.036-.198-.034-.202-.033-.205-.032-.21-.031-.212-.028-.216-.027-.22-.026-.224-.023-.226-.022-.231-.021-.233-.018-.237-.016-.241-.014-.244-.012-.247-.011-.25-.008-.254-.005-.257-.004-.26-.001-.26.001z\"></path></symbol></defs><defs><symbol id=\"diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-clock\" width=\"24\" height=\"24\"><path transform=\"scale(.5)\" d=\"M12 2c5.514 0 10 4.486 10 10s-4.486 10-10 10-10-4.486-10-10 4.486-10 10-10zm0-2c-6.627 0-12 5.373-12 12s5.373 12 12 12 12-5.373 12-12-5.373-12-12-12zm5.848 12.459c.202.038.202.333.001.372-1.907.361-6.045 1.111-6.547 1.111-.719 0-1.301-.582-1.301-1.301 0-.512.77-5.447 1.125-7.445.034-.192.312-.181.343.014l.985 6.238 5.394 1.011z\"></path></symbol></defs><defs><marker id=\"diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-arrowhead\" refX=\"7.9\" refY=\"5\" markerUnits=\"userSpaceOnUse\" markerWidth=\"12\" markerHeight=\"12\" orient=\"auto-start-reverse\"><path d=\"M -1 0 L 10 5 L 0 10 z\"></path></marker></defs><defs><marker id=\"diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-crosshead\" markerWidth=\"15\" markerHeight=\"8\" orient=\"auto\" refX=\"4\" refY=\"4.5\"><path fill=\"none\" stroke=\"#000000\" stroke-width=\"1pt\" d=\"M 1,2 L 6,7 M 6,2 L 1,7\" style=\"stroke-dasharray: 0, 0;\"></path></marker></defs><defs><marker id=\"diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-filled-head\" refX=\"15.5\" refY=\"7\" markerWidth=\"20\" markerHeight=\"28\" orient=\"auto\"><path d=\"M 18,7 L9,13 L14,7 L9,1 Z\"></path></marker></defs><defs><marker id=\"diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-sequencenumber\" refX=\"15\" refY=\"15\" markerWidth=\"60\" markerHeight=\"40\" orient=\"auto\"><circle cx=\"15\" cy=\"15\" r=\"6\"></circle></marker></defs><defs><marker id=\"diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-solidTopArrowHead\" refX=\"7.9\" refY=\"7.25\" markerUnits=\"userSpaceOnUse\" markerWidth=\"12\" markerHeight=\"12\" orient=\"auto-start-reverse\"><path d=\"M 0 0 L 10 8 L 0 8 z\"></path></marker></defs><defs><marker id=\"diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-solidBottomArrowHead\" refX=\"7.9\" refY=\"0.75\" markerUnits=\"userSpaceOnUse\" markerWidth=\"12\" markerHeight=\"12\" orient=\"auto-start-reverse\"><path d=\"M 0 0 L 10 0 L 0 8 z\"></path></marker></defs><defs><marker id=\"diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-stickTopArrowHead\" refX=\"7.5\" refY=\"7\" markerUnits=\"userSpaceOnUse\" markerWidth=\"12\" markerHeight=\"12\" orient=\"auto-start-reverse\"><path d=\"M 0 0 L 7 7\" stroke=\"black\" stroke-width=\"1.5\" fill=\"none\"></path></marker></defs><defs><marker id=\"diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-stickBottomArrowHead\" refX=\"7.5\" refY=\"0\" markerUnits=\"userSpaceOnUse\" markerWidth=\"12\" markerHeight=\"12\" orient=\"auto-start-reverse\"><path d=\"M 0 7 L 7 0\" stroke=\"black\" stroke-width=\"1.5\" fill=\"none\"></path></marker></defs><text x=\"377\" y=\"80\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">Redirect to consent URL with client_id, redirect_uri, scope, PKCE challenge</text><line x1=\"76\" y1=\"111\" x2=\"677\" y2=\"111\" class=\"messageLine0\" data-et=\"message\" data-id=\"i0\" data-from=\"App\" data-to=\"Browser\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-arrowhead)\" style=\"fill: none;\"></line><text x=\"838\" y=\"126\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">User opens authorize link</text><line x1=\"682\" y1=\"157\" x2=\"994\" y2=\"157\" class=\"messageLine0\" data-et=\"message\" data-id=\"i1\" data-from=\"Browser\" data-to=\"Consent\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-arrowhead)\" style=\"fill: none;\"></line><text x=\"841\" y=\"172\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">Login (if needed) + consent screen</text><line x1=\"997\" y1=\"203\" x2=\"685\" y2=\"203\" class=\"messageLine0\" data-et=\"message\" data-id=\"i2\" data-from=\"Consent\" data-to=\"Browser\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-arrowhead)\" style=\"fill: none;\"></line><text x=\"838\" y=\"218\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">User clicks Allow access</text><line x1=\"682\" y1=\"247\" x2=\"994\" y2=\"247\" class=\"messageLine0\" data-et=\"message\" data-id=\"i3\" data-from=\"Browser\" data-to=\"Consent\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-arrowhead)\" style=\"fill: none;\"></line><text x=\"1172\" y=\"262\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">GET /v1/oauth/authorize (session JWT)</text><line x1=\"999\" y1=\"293\" x2=\"1344\" y2=\"293\" class=\"messageLine0\" data-et=\"message\" data-id=\"i4\" data-from=\"Consent\" data-to=\"API\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-arrowhead)\" style=\"fill: none;\"></line><text x=\"1016\" y=\"308\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">Redirect to redirect_uri?code=...&amp;state=...</text><line x1=\"1347\" y1=\"339\" x2=\"685\" y2=\"339\" class=\"messageLine0\" data-et=\"message\" data-id=\"i5\" data-from=\"API\" data-to=\"Browser\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-arrowhead)\" style=\"fill: none;\"></line><text x=\"380\" y=\"354\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">Callback with authorization code</text><line x1=\"680\" y1=\"383\" x2=\"79\" y2=\"383\" class=\"messageLine0\" data-et=\"message\" data-id=\"i6\" data-from=\"Browser\" data-to=\"App\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-arrowhead)\" style=\"fill: none;\"></line><text x=\"710\" y=\"398\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">POST /v1/oauth/token (code + code_verifier)</text><line x1=\"76\" y1=\"429\" x2=\"1344\" y2=\"429\" class=\"messageLine0\" data-et=\"message\" data-id=\"i7\" data-from=\"App\" data-to=\"API\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-arrowhead)\" style=\"fill: none;\"></line><text x=\"713\" y=\"444\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">access_token, refresh_token, expires_in, scope</text><line x1=\"1347\" y1=\"475\" x2=\"79\" y2=\"475\" class=\"messageLine0\" data-et=\"message\" data-id=\"i8\" data-from=\"API\" data-to=\"App\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-arrowhead)\" style=\"fill: none;\"></line><text x=\"710\" y=\"490\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">API calls with Authorization Bearer access_token</text><line x1=\"76\" y1=\"521\" x2=\"1344\" y2=\"521\" class=\"messageLine0\" data-et=\"message\" data-id=\"i9\" data-from=\"App\" data-to=\"API\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-b0921d9734b70a13005da307756534ed8defbf9c9803838d7ae53d5557d737a9-arrowhead)\" style=\"fill: none;\"></line></svg>","diagramHtmlDark":"<svg id=\"diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53\" width=\"100%\" xmlns=\"http://www.w3.org/2000/svg\" style=\"max-width: 1527.5px;\" viewBox=\"-50 -10 1527.5 627\" role=\"graphics-document document\" aria-roledescription=\"sequence\"><style>\n    #diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 foreignObject {\n      overflow: visible;\n    }\n  </style><g><rect x=\"1268.5\" y=\"541\" fill=\"#eaeaea\" stroke=\"#666\" width=\"159\" height=\"65\" name=\"API\" rx=\"3\" ry=\"3\" class=\"actor actor-bottom\"></rect><text x=\"1348\" y=\"573.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"1348\" dy=\"0\">public.api.iclosed.io</tspan></text></g><g><rect x=\"881.5\" y=\"541\" fill=\"#eaeaea\" stroke=\"#666\" width=\"233\" height=\"65\" name=\"Consent\" rx=\"3\" ry=\"3\" class=\"actor actor-bottom\"></rect><text x=\"998\" y=\"573.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"998\" dy=\"0\">app.iclosed.io/oauth/authorize</tspan></text></g><g><rect x=\"606\" y=\"541\" fill=\"#eaeaea\" stroke=\"#666\" width=\"150\" height=\"65\" name=\"Browser\" rx=\"3\" ry=\"3\" class=\"actor actor-bottom\"></rect><text x=\"681\" y=\"573.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"681\" dy=\"0\">User browser</tspan></text></g><g><rect x=\"0\" y=\"541\" fill=\"#eaeaea\" stroke=\"#666\" width=\"150\" height=\"65\" name=\"App\" rx=\"3\" ry=\"3\" class=\"actor actor-bottom\"></rect><text x=\"75\" y=\"573.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"75\" dy=\"0\">Your app</tspan></text></g><g><line id=\"actor3\" x1=\"1348\" y1=\"65\" x2=\"1348\" y2=\"541\" class=\"actor-line 200\" stroke-width=\"0.5px\" stroke=\"#999\" name=\"API\" data-et=\"life-line\" data-id=\"API\"></line><g id=\"root-3\" data-et=\"participant\" data-type=\"participant\" data-id=\"API\"><rect x=\"1268.5\" y=\"0\" fill=\"#eaeaea\" stroke=\"#666\" width=\"159\" height=\"65\" name=\"API\" rx=\"3\" ry=\"3\" class=\"actor actor-top\"></rect><text x=\"1348\" y=\"32.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"1348\" dy=\"0\">public.api.iclosed.io</tspan></text></g></g><g><line id=\"actor2\" x1=\"998\" y1=\"65\" x2=\"998\" y2=\"541\" class=\"actor-line 200\" stroke-width=\"0.5px\" stroke=\"#999\" name=\"Consent\" data-et=\"life-line\" data-id=\"Consent\"></line><g id=\"root-2\" data-et=\"participant\" data-type=\"participant\" data-id=\"Consent\"><rect x=\"881.5\" y=\"0\" fill=\"#eaeaea\" stroke=\"#666\" width=\"233\" height=\"65\" name=\"Consent\" rx=\"3\" ry=\"3\" class=\"actor actor-top\"></rect><text x=\"998\" y=\"32.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"998\" dy=\"0\">app.iclosed.io/oauth/authorize</tspan></text></g></g><g><line id=\"actor1\" x1=\"681\" y1=\"65\" x2=\"681\" y2=\"541\" class=\"actor-line 200\" stroke-width=\"0.5px\" stroke=\"#999\" name=\"Browser\" data-et=\"life-line\" data-id=\"Browser\"></line><g id=\"root-1\" data-et=\"participant\" data-type=\"participant\" data-id=\"Browser\"><rect x=\"606\" y=\"0\" fill=\"#eaeaea\" stroke=\"#666\" width=\"150\" height=\"65\" name=\"Browser\" rx=\"3\" ry=\"3\" class=\"actor actor-top\"></rect><text x=\"681\" y=\"32.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"681\" dy=\"0\">User browser</tspan></text></g></g><g><line id=\"actor0\" x1=\"75\" y1=\"65\" x2=\"75\" y2=\"541\" class=\"actor-line 200\" stroke-width=\"0.5px\" stroke=\"#999\" name=\"App\" data-et=\"life-line\" data-id=\"App\"></line><g id=\"root-0\" data-et=\"participant\" data-type=\"participant\" data-id=\"App\"><rect x=\"0\" y=\"0\" fill=\"#eaeaea\" stroke=\"#666\" width=\"150\" height=\"65\" name=\"App\" rx=\"3\" ry=\"3\" class=\"actor actor-top\"></rect><text x=\"75\" y=\"32.5\" dominant-baseline=\"central\" alignment-baseline=\"central\" class=\"actor actor-box\" style=\"text-anchor: middle; font-size: 16px; font-weight: 400; font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif;\"><tspan x=\"75\" dy=\"0\">Your app</tspan></text></g></g><style>#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53{font-family:\"Redocly Mermaid Sans\",Arial,\"Liberation Sans\",Arimo,Helvetica,\"Redocly Mermaid CJK\",sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .error-icon{fill:#a44141;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .error-text{fill:#ddd;stroke:#ddd;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .edge-thickness-normal{stroke-width:1px;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .edge-thickness-thick{stroke-width:3.5px;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .edge-pattern-solid{stroke-dasharray:0;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .edge-thickness-invisible{stroke-width:0;fill:none;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .edge-pattern-dashed{stroke-dasharray:3;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .edge-pattern-dotted{stroke-dasharray:2;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .marker{fill:lightgrey;stroke:lightgrey;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .marker.cross{stroke:lightgrey;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 svg{font-family:\"Redocly Mermaid Sans\",Arial,\"Liberation Sans\",Arimo,Helvetica,\"Redocly Mermaid CJK\",sans-serif;font-size:16px;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 p{margin:0;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .actor{stroke:#ccc;fill:#1f2020;stroke-width:1;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 rect.actor.outer-path[data-look=\"neo\"]{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 rect.note[data-look=\"neo\"]{stroke:hsl(180, 0%, 18.3529411765%);fill:hsl(180, 1.5873015873%, 28.3529411765%);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 text.actor&gt;tspan{fill:lightgrey;stroke:none;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .actor-line{stroke:#ccc;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .innerArc{stroke-width:1.5;stroke-dasharray:none;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:lightgrey;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:lightgrey;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [id$=\"-arrowhead\"] path{fill:lightgrey;stroke:lightgrey;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .sequenceNumber{fill:black;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [id$=\"-sequencenumber\"]{fill:lightgrey;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [id$=\"-crosshead\"] path{fill:lightgrey;stroke:lightgrey;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .messageText{fill:lightgrey;stroke:none;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .labelBox{stroke:#ccc;fill:#1f2020;filter:none;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .labelText,#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .labelText&gt;tspan{fill:lightgrey;stroke:none;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .loopText,#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .loopText&gt;tspan{fill:lightgrey;stroke:none;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .sectionTitle,#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .sectionTitle&gt;tspan{fill:lightgrey;stroke:none;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:#ccc;fill:#ccc;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .note{stroke:hsl(180, 0%, 18.3529411765%);fill:hsl(180, 1.5873015873%, 28.3529411765%);}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .noteText,#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .noteText&gt;tspan{fill:rgb(183.8476190475, 181.5523809523, 181.5523809523);stroke:none;font-weight:normal;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .activation0{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:#ccc;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .activation1{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:#ccc;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .activation2{fill:hsl(180, 1.5873015873%, 28.3529411765%);stroke:#ccc;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .actorPopupMenu{position:absolute;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .actorPopupMenuPanel{position:absolute;fill:#1f2020;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .actor-man circle,#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 line{fill:#1f2020;stroke-width:2px;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 g rect.rect{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));stroke:#ccc;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 .node .neo-node{stroke:#ccc;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [data-look=\"neo\"].node rect,#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [data-look=\"neo\"].cluster rect,#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [data-look=\"neo\"].node polygon{stroke:url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [data-look=\"neo\"].swimlane.cluster rect{filter:none;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [data-look=\"neo\"].node path{stroke:url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-gradient);stroke-width:1px;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [data-look=\"neo\"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [data-look=\"neo\"].node .neo-line path{stroke:#ccc;filter:none;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [data-look=\"neo\"].node circle{stroke:url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [data-look=\"neo\"].node circle .state-start{fill:#000000;}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [data-look=\"neo\"].icon-shape .icon{fill:url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 [data-look=\"neo\"].icon-shape .icon-neo path{stroke:url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53 :root{--mermaid-font-family:\"Redocly Mermaid Sans\",Arial,\"Liberation Sans\",Arimo,Helvetica,\"Redocly Mermaid CJK\",sans-serif;}</style><g></g><defs><symbol id=\"diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-computer\" width=\"24\" height=\"24\"><path transform=\"scale(.5)\" d=\"M2 2v13h20v-13h-20zm18 11h-16v-9h16v9zm-10.228 6l.466-1h3.524l.467 1h-4.457zm14.228 3h-24l2-6h2.104l-1.33 4h18.45l-1.297-4h2.073l2 6zm-5-10h-14v-7h14v7z\"></path></symbol></defs><defs><symbol id=\"diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-database\" fill-rule=\"evenodd\" clip-rule=\"evenodd\"><path transform=\"scale(.5)\" d=\"M12.258.001l.256.004.255.005.253.008.251.01.249.012.247.015.246.016.242.019.241.02.239.023.236.024.233.027.231.028.229.031.225.032.223.034.22.036.217.038.214.04.211.041.208.043.205.045.201.046.198.048.194.05.191.051.187.053.183.054.18.056.175.057.172.059.168.06.163.061.16.063.155.064.15.066.074.033.073.033.071.034.07.034.069.035.068.035.067.035.066.035.064.036.064.036.062.036.06.036.06.037.058.037.058.037.055.038.055.038.053.038.052.038.051.039.05.039.048.039.047.039.045.04.044.04.043.04.041.04.04.041.039.041.037.041.036.041.034.041.033.042.032.042.03.042.029.042.027.042.026.043.024.043.023.043.021.043.02.043.018.044.017.043.015.044.013.044.012.044.011.045.009.044.007.045.006.045.004.045.002.045.001.045v17l-.001.045-.002.045-.004.045-.006.045-.007.045-.009.044-.011.045-.012.044-.013.044-.015.044-.017.043-.018.044-.02.043-.021.043-.023.043-.024.043-.026.043-.027.042-.029.042-.03.042-.032.042-.033.042-.034.041-.036.041-.037.041-.039.041-.04.041-.041.04-.043.04-.044.04-.045.04-.047.039-.048.039-.05.039-.051.039-.052.038-.053.038-.055.038-.055.038-.058.037-.058.037-.06.037-.06.036-.062.036-.064.036-.064.036-.066.035-.067.035-.068.035-.069.035-.07.034-.071.034-.073.033-.074.033-.15.066-.155.064-.16.063-.163.061-.168.06-.172.059-.175.057-.18.056-.183.054-.187.053-.191.051-.194.05-.198.048-.201.046-.205.045-.208.043-.211.041-.214.04-.217.038-.22.036-.223.034-.225.032-.229.031-.231.028-.233.027-.236.024-.239.023-.241.02-.242.019-.246.016-.247.015-.249.012-.251.01-.253.008-.255.005-.256.004-.258.001-.258-.001-.256-.004-.255-.005-.253-.008-.251-.01-.249-.012-.247-.015-.245-.016-.243-.019-.241-.02-.238-.023-.236-.024-.234-.027-.231-.028-.228-.031-.226-.032-.223-.034-.22-.036-.217-.038-.214-.04-.211-.041-.208-.043-.204-.045-.201-.046-.198-.048-.195-.05-.19-.051-.187-.053-.184-.054-.179-.056-.176-.057-.172-.059-.167-.06-.164-.061-.159-.063-.155-.064-.151-.066-.074-.033-.072-.033-.072-.034-.07-.034-.069-.035-.068-.035-.067-.035-.066-.035-.064-.036-.063-.036-.062-.036-.061-.036-.06-.037-.058-.037-.057-.037-.056-.038-.055-.038-.053-.038-.052-.038-.051-.039-.049-.039-.049-.039-.046-.039-.046-.04-.044-.04-.043-.04-.041-.04-.04-.041-.039-.041-.037-.041-.036-.041-.034-.041-.033-.042-.032-.042-.03-.042-.029-.042-.027-.042-.026-.043-.024-.043-.023-.043-.021-.043-.02-.043-.018-.044-.017-.043-.015-.044-.013-.044-.012-.044-.011-.045-.009-.044-.007-.045-.006-.045-.004-.045-.002-.045-.001-.045v-17l.001-.045.002-.045.004-.045.006-.045.007-.045.009-.044.011-.045.012-.044.013-.044.015-.044.017-.043.018-.044.02-.043.021-.043.023-.043.024-.043.026-.043.027-.042.029-.042.03-.042.032-.042.033-.042.034-.041.036-.041.037-.041.039-.041.04-.041.041-.04.043-.04.044-.04.046-.04.046-.039.049-.039.049-.039.051-.039.052-.038.053-.038.055-.038.056-.038.057-.037.058-.037.06-.037.061-.036.062-.036.063-.036.064-.036.066-.035.067-.035.068-.035.069-.035.07-.034.072-.034.072-.033.074-.033.151-.066.155-.064.159-.063.164-.061.167-.06.172-.059.176-.057.179-.056.184-.054.187-.053.19-.051.195-.05.198-.048.201-.046.204-.045.208-.043.211-.041.214-.04.217-.038.22-.036.223-.034.226-.032.228-.031.231-.028.234-.027.236-.024.238-.023.241-.02.243-.019.245-.016.247-.015.249-.012.251-.01.253-.008.255-.005.256-.004.258-.001.258.001zm-9.258 20.499v.01l.001.021.003.021.004.022.005.021.006.022.007.022.009.023.01.022.011.023.012.023.013.023.015.023.016.024.017.023.018.024.019.024.021.024.022.025.023.024.024.025.052.049.056.05.061.051.066.051.07.051.075.051.079.052.084.052.088.052.092.052.097.052.102.051.105.052.11.052.114.051.119.051.123.051.127.05.131.05.135.05.139.048.144.049.147.047.152.047.155.047.16.045.163.045.167.043.171.043.176.041.178.041.183.039.187.039.19.037.194.035.197.035.202.033.204.031.209.03.212.029.216.027.219.025.222.024.226.021.23.02.233.018.236.016.24.015.243.012.246.01.249.008.253.005.256.004.259.001.26-.001.257-.004.254-.005.25-.008.247-.011.244-.012.241-.014.237-.016.233-.018.231-.021.226-.021.224-.024.22-.026.216-.027.212-.028.21-.031.205-.031.202-.034.198-.034.194-.036.191-.037.187-.039.183-.04.179-.04.175-.042.172-.043.168-.044.163-.045.16-.046.155-.046.152-.047.148-.048.143-.049.139-.049.136-.05.131-.05.126-.05.123-.051.118-.052.114-.051.11-.052.106-.052.101-.052.096-.052.092-.052.088-.053.083-.051.079-.052.074-.052.07-.051.065-.051.06-.051.056-.05.051-.05.023-.024.023-.025.021-.024.02-.024.019-.024.018-.024.017-.024.015-.023.014-.024.013-.023.012-.023.01-.023.01-.022.008-.022.006-.022.006-.022.004-.022.004-.021.001-.021.001-.021v-4.127l-.077.055-.08.053-.083.054-.085.053-.087.052-.09.052-.093.051-.095.05-.097.05-.1.049-.102.049-.105.048-.106.047-.109.047-.111.046-.114.045-.115.045-.118.044-.12.043-.122.042-.124.042-.126.041-.128.04-.13.04-.132.038-.134.038-.135.037-.138.037-.139.035-.142.035-.143.034-.144.033-.147.032-.148.031-.15.03-.151.03-.153.029-.154.027-.156.027-.158.026-.159.025-.161.024-.162.023-.163.022-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.011-.178.01-.179.008-.179.008-.181.006-.182.005-.182.004-.184.003-.184.002h-.37l-.184-.002-.184-.003-.182-.004-.182-.005-.181-.006-.179-.008-.179-.008-.178-.01-.176-.011-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.022-.162-.023-.161-.024-.159-.025-.157-.026-.156-.027-.155-.027-.153-.029-.151-.03-.15-.03-.148-.031-.146-.032-.145-.033-.143-.034-.141-.035-.14-.035-.137-.037-.136-.037-.134-.038-.132-.038-.13-.04-.128-.04-.126-.041-.124-.042-.122-.042-.12-.044-.117-.043-.116-.045-.113-.045-.112-.046-.109-.047-.106-.047-.105-.048-.102-.049-.1-.049-.097-.05-.095-.05-.093-.052-.09-.051-.087-.052-.085-.053-.083-.054-.08-.054-.077-.054v4.127zm0-5.654v.011l.001.021.003.021.004.021.005.022.006.022.007.022.009.022.01.022.011.023.012.023.013.023.015.024.016.023.017.024.018.024.019.024.021.024.022.024.023.025.024.024.052.05.056.05.061.05.066.051.07.051.075.052.079.051.084.052.088.052.092.052.097.052.102.052.105.052.11.051.114.051.119.052.123.05.127.051.131.05.135.049.139.049.144.048.147.048.152.047.155.046.16.045.163.045.167.044.171.042.176.042.178.04.183.04.187.038.19.037.194.036.197.034.202.033.204.032.209.03.212.028.216.027.219.025.222.024.226.022.23.02.233.018.236.016.24.014.243.012.246.01.249.008.253.006.256.003.259.001.26-.001.257-.003.254-.006.25-.008.247-.01.244-.012.241-.015.237-.016.233-.018.231-.02.226-.022.224-.024.22-.025.216-.027.212-.029.21-.03.205-.032.202-.033.198-.035.194-.036.191-.037.187-.039.183-.039.179-.041.175-.042.172-.043.168-.044.163-.045.16-.045.155-.047.152-.047.148-.048.143-.048.139-.05.136-.049.131-.05.126-.051.123-.051.118-.051.114-.052.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.051.07-.052.065-.051.06-.05.056-.051.051-.049.023-.025.023-.024.021-.025.02-.024.019-.024.018-.024.017-.024.015-.023.014-.023.013-.024.012-.022.01-.023.01-.023.008-.022.006-.022.006-.022.004-.021.004-.022.001-.021.001-.021v-4.139l-.077.054-.08.054-.083.054-.085.052-.087.053-.09.051-.093.051-.095.051-.097.05-.1.049-.102.049-.105.048-.106.047-.109.047-.111.046-.114.045-.115.044-.118.044-.12.044-.122.042-.124.042-.126.041-.128.04-.13.039-.132.039-.134.038-.135.037-.138.036-.139.036-.142.035-.143.033-.144.033-.147.033-.148.031-.15.03-.151.03-.153.028-.154.028-.156.027-.158.026-.159.025-.161.024-.162.023-.163.022-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.011-.178.009-.179.009-.179.007-.181.007-.182.005-.182.004-.184.003-.184.002h-.37l-.184-.002-.184-.003-.182-.004-.182-.005-.181-.007-.179-.007-.179-.009-.178-.009-.176-.011-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.022-.162-.023-.161-.024-.159-.025-.157-.026-.156-.027-.155-.028-.153-.028-.151-.03-.15-.03-.148-.031-.146-.033-.145-.033-.143-.033-.141-.035-.14-.036-.137-.036-.136-.037-.134-.038-.132-.039-.13-.039-.128-.04-.126-.041-.124-.042-.122-.043-.12-.043-.117-.044-.116-.044-.113-.046-.112-.046-.109-.046-.106-.047-.105-.048-.102-.049-.1-.049-.097-.05-.095-.051-.093-.051-.09-.051-.087-.053-.085-.052-.083-.054-.08-.054-.077-.054v4.139zm0-5.666v.011l.001.02.003.022.004.021.005.022.006.021.007.022.009.023.01.022.011.023.012.023.013.023.015.023.016.024.017.024.018.023.019.024.021.025.022.024.023.024.024.025.052.05.056.05.061.05.066.051.07.051.075.052.079.051.084.052.088.052.092.052.097.052.102.052.105.051.11.052.114.051.119.051.123.051.127.05.131.05.135.05.139.049.144.048.147.048.152.047.155.046.16.045.163.045.167.043.171.043.176.042.178.04.183.04.187.038.19.037.194.036.197.034.202.033.204.032.209.03.212.028.216.027.219.025.222.024.226.021.23.02.233.018.236.017.24.014.243.012.246.01.249.008.253.006.256.003.259.001.26-.001.257-.003.254-.006.25-.008.247-.01.244-.013.241-.014.237-.016.233-.018.231-.02.226-.022.224-.024.22-.025.216-.027.212-.029.21-.03.205-.032.202-.033.198-.035.194-.036.191-.037.187-.039.183-.039.179-.041.175-.042.172-.043.168-.044.163-.045.16-.045.155-.047.152-.047.148-.048.143-.049.139-.049.136-.049.131-.051.126-.05.123-.051.118-.052.114-.051.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.052.07-.051.065-.051.06-.051.056-.05.051-.049.023-.025.023-.025.021-.024.02-.024.019-.024.018-.024.017-.024.015-.023.014-.024.013-.023.012-.023.01-.022.01-.023.008-.022.006-.022.006-.022.004-.022.004-.021.001-.021.001-.021v-4.153l-.077.054-.08.054-.083.053-.085.053-.087.053-.09.051-.093.051-.095.051-.097.05-.1.049-.102.048-.105.048-.106.048-.109.046-.111.046-.114.046-.115.044-.118.044-.12.043-.122.043-.124.042-.126.041-.128.04-.13.039-.132.039-.134.038-.135.037-.138.036-.139.036-.142.034-.143.034-.144.033-.147.032-.148.032-.15.03-.151.03-.153.028-.154.028-.156.027-.158.026-.159.024-.161.024-.162.023-.163.023-.165.021-.166.02-.167.019-.169.018-.169.017-.171.016-.173.015-.173.014-.175.013-.175.012-.177.01-.178.01-.179.009-.179.007-.181.006-.182.006-.182.004-.184.003-.184.001-.185.001-.185-.001-.184-.001-.184-.003-.182-.004-.182-.006-.181-.006-.179-.007-.179-.009-.178-.01-.176-.01-.176-.012-.175-.013-.173-.014-.172-.015-.171-.016-.17-.017-.169-.018-.167-.019-.166-.02-.165-.021-.163-.023-.162-.023-.161-.024-.159-.024-.157-.026-.156-.027-.155-.028-.153-.028-.151-.03-.15-.03-.148-.032-.146-.032-.145-.033-.143-.034-.141-.034-.14-.036-.137-.036-.136-.037-.134-.038-.132-.039-.13-.039-.128-.041-.126-.041-.124-.041-.122-.043-.12-.043-.117-.044-.116-.044-.113-.046-.112-.046-.109-.046-.106-.048-.105-.048-.102-.048-.1-.05-.097-.049-.095-.051-.093-.051-.09-.052-.087-.052-.085-.053-.083-.053-.08-.054-.077-.054v4.153zm8.74-8.179l-.257.004-.254.005-.25.008-.247.011-.244.012-.241.014-.237.016-.233.018-.231.021-.226.022-.224.023-.22.026-.216.027-.212.028-.21.031-.205.032-.202.033-.198.034-.194.036-.191.038-.187.038-.183.04-.179.041-.175.042-.172.043-.168.043-.163.045-.16.046-.155.046-.152.048-.148.048-.143.048-.139.049-.136.05-.131.05-.126.051-.123.051-.118.051-.114.052-.11.052-.106.052-.101.052-.096.052-.092.052-.088.052-.083.052-.079.052-.074.051-.07.052-.065.051-.06.05-.056.05-.051.05-.023.025-.023.024-.021.024-.02.025-.019.024-.018.024-.017.023-.015.024-.014.023-.013.023-.012.023-.01.023-.01.022-.008.022-.006.023-.006.021-.004.022-.004.021-.001.021-.001.021.001.021.001.021.004.021.004.022.006.021.006.023.008.022.01.022.01.023.012.023.013.023.014.023.015.024.017.023.018.024.019.024.02.025.021.024.023.024.023.025.051.05.056.05.06.05.065.051.07.052.074.051.079.052.083.052.088.052.092.052.096.052.101.052.106.052.11.052.114.052.118.051.123.051.126.051.131.05.136.05.139.049.143.048.148.048.152.048.155.046.16.046.163.045.168.043.172.043.175.042.179.041.183.04.187.038.191.038.194.036.198.034.202.033.205.032.21.031.212.028.216.027.22.026.224.023.226.022.231.021.233.018.237.016.241.014.244.012.247.011.25.008.254.005.257.004.26.001.26-.001.257-.004.254-.005.25-.008.247-.011.244-.012.241-.014.237-.016.233-.018.231-.021.226-.022.224-.023.22-.026.216-.027.212-.028.21-.031.205-.032.202-.033.198-.034.194-.036.191-.038.187-.038.183-.04.179-.041.175-.042.172-.043.168-.043.163-.045.16-.046.155-.046.152-.048.148-.048.143-.048.139-.049.136-.05.131-.05.126-.051.123-.051.118-.051.114-.052.11-.052.106-.052.101-.052.096-.052.092-.052.088-.052.083-.052.079-.052.074-.051.07-.052.065-.051.06-.05.056-.05.051-.05.023-.025.023-.024.021-.024.02-.025.019-.024.018-.024.017-.023.015-.024.014-.023.013-.023.012-.023.01-.023.01-.022.008-.022.006-.023.006-.021.004-.022.004-.021.001-.021.001-.021-.001-.021-.001-.021-.004-.021-.004-.022-.006-.021-.006-.023-.008-.022-.01-.022-.01-.023-.012-.023-.013-.023-.014-.023-.015-.024-.017-.023-.018-.024-.019-.024-.02-.025-.021-.024-.023-.024-.023-.025-.051-.05-.056-.05-.06-.05-.065-.051-.07-.052-.074-.051-.079-.052-.083-.052-.088-.052-.092-.052-.096-.052-.101-.052-.106-.052-.11-.052-.114-.052-.118-.051-.123-.051-.126-.051-.131-.05-.136-.05-.139-.049-.143-.048-.148-.048-.152-.048-.155-.046-.16-.046-.163-.045-.168-.043-.172-.043-.175-.042-.179-.041-.183-.04-.187-.038-.191-.038-.194-.036-.198-.034-.202-.033-.205-.032-.21-.031-.212-.028-.216-.027-.22-.026-.224-.023-.226-.022-.231-.021-.233-.018-.237-.016-.241-.014-.244-.012-.247-.011-.25-.008-.254-.005-.257-.004-.26-.001-.26.001z\"></path></symbol></defs><defs><symbol id=\"diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-clock\" width=\"24\" height=\"24\"><path transform=\"scale(.5)\" d=\"M12 2c5.514 0 10 4.486 10 10s-4.486 10-10 10-10-4.486-10-10 4.486-10 10-10zm0-2c-6.627 0-12 5.373-12 12s5.373 12 12 12 12-5.373 12-12-5.373-12-12-12zm5.848 12.459c.202.038.202.333.001.372-1.907.361-6.045 1.111-6.547 1.111-.719 0-1.301-.582-1.301-1.301 0-.512.77-5.447 1.125-7.445.034-.192.312-.181.343.014l.985 6.238 5.394 1.011z\"></path></symbol></defs><defs><marker id=\"diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-arrowhead\" refX=\"7.9\" refY=\"5\" markerUnits=\"userSpaceOnUse\" markerWidth=\"12\" markerHeight=\"12\" orient=\"auto-start-reverse\"><path d=\"M -1 0 L 10 5 L 0 10 z\"></path></marker></defs><defs><marker id=\"diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-crosshead\" markerWidth=\"15\" markerHeight=\"8\" orient=\"auto\" refX=\"4\" refY=\"4.5\"><path fill=\"none\" stroke=\"#000000\" stroke-width=\"1pt\" d=\"M 1,2 L 6,7 M 6,2 L 1,7\" style=\"stroke-dasharray: 0, 0;\"></path></marker></defs><defs><marker id=\"diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-filled-head\" refX=\"15.5\" refY=\"7\" markerWidth=\"20\" markerHeight=\"28\" orient=\"auto\"><path d=\"M 18,7 L9,13 L14,7 L9,1 Z\"></path></marker></defs><defs><marker id=\"diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-sequencenumber\" refX=\"15\" refY=\"15\" markerWidth=\"60\" markerHeight=\"40\" orient=\"auto\"><circle cx=\"15\" cy=\"15\" r=\"6\"></circle></marker></defs><defs><marker id=\"diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-solidTopArrowHead\" refX=\"7.9\" refY=\"7.25\" markerUnits=\"userSpaceOnUse\" markerWidth=\"12\" markerHeight=\"12\" orient=\"auto-start-reverse\"><path d=\"M 0 0 L 10 8 L 0 8 z\"></path></marker></defs><defs><marker id=\"diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-solidBottomArrowHead\" refX=\"7.9\" refY=\"0.75\" markerUnits=\"userSpaceOnUse\" markerWidth=\"12\" markerHeight=\"12\" orient=\"auto-start-reverse\"><path d=\"M 0 0 L 10 0 L 0 8 z\"></path></marker></defs><defs><marker id=\"diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-stickTopArrowHead\" refX=\"7.5\" refY=\"7\" markerUnits=\"userSpaceOnUse\" markerWidth=\"12\" markerHeight=\"12\" orient=\"auto-start-reverse\"><path d=\"M 0 0 L 7 7\" stroke=\"black\" stroke-width=\"1.5\" fill=\"none\"></path></marker></defs><defs><marker id=\"diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-stickBottomArrowHead\" refX=\"7.5\" refY=\"0\" markerUnits=\"userSpaceOnUse\" markerWidth=\"12\" markerHeight=\"12\" orient=\"auto-start-reverse\"><path d=\"M 0 7 L 7 0\" stroke=\"black\" stroke-width=\"1.5\" fill=\"none\"></path></marker></defs><text x=\"377\" y=\"80\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">Redirect to consent URL with client_id, redirect_uri, scope, PKCE challenge</text><line x1=\"76\" y1=\"111\" x2=\"677\" y2=\"111\" class=\"messageLine0\" data-et=\"message\" data-id=\"i0\" data-from=\"App\" data-to=\"Browser\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-arrowhead)\" style=\"fill: none;\"></line><text x=\"838\" y=\"126\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">User opens authorize link</text><line x1=\"682\" y1=\"157\" x2=\"994\" y2=\"157\" class=\"messageLine0\" data-et=\"message\" data-id=\"i1\" data-from=\"Browser\" data-to=\"Consent\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-arrowhead)\" style=\"fill: none;\"></line><text x=\"841\" y=\"172\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">Login (if needed) + consent screen</text><line x1=\"997\" y1=\"203\" x2=\"685\" y2=\"203\" class=\"messageLine0\" data-et=\"message\" data-id=\"i2\" data-from=\"Consent\" data-to=\"Browser\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-arrowhead)\" style=\"fill: none;\"></line><text x=\"838\" y=\"218\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">User clicks Allow access</text><line x1=\"682\" y1=\"247\" x2=\"994\" y2=\"247\" class=\"messageLine0\" data-et=\"message\" data-id=\"i3\" data-from=\"Browser\" data-to=\"Consent\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-arrowhead)\" style=\"fill: none;\"></line><text x=\"1172\" y=\"262\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">GET /v1/oauth/authorize (session JWT)</text><line x1=\"999\" y1=\"293\" x2=\"1344\" y2=\"293\" class=\"messageLine0\" data-et=\"message\" data-id=\"i4\" data-from=\"Consent\" data-to=\"API\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-arrowhead)\" style=\"fill: none;\"></line><text x=\"1016\" y=\"308\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">Redirect to redirect_uri?code=...&amp;state=...</text><line x1=\"1347\" y1=\"339\" x2=\"685\" y2=\"339\" class=\"messageLine0\" data-et=\"message\" data-id=\"i5\" data-from=\"API\" data-to=\"Browser\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-arrowhead)\" style=\"fill: none;\"></line><text x=\"380\" y=\"354\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">Callback with authorization code</text><line x1=\"680\" y1=\"383\" x2=\"79\" y2=\"383\" class=\"messageLine0\" data-et=\"message\" data-id=\"i6\" data-from=\"Browser\" data-to=\"App\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-arrowhead)\" style=\"fill: none;\"></line><text x=\"710\" y=\"398\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">POST /v1/oauth/token (code + code_verifier)</text><line x1=\"76\" y1=\"429\" x2=\"1344\" y2=\"429\" class=\"messageLine0\" data-et=\"message\" data-id=\"i7\" data-from=\"App\" data-to=\"API\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-arrowhead)\" style=\"fill: none;\"></line><text x=\"713\" y=\"444\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">access_token, refresh_token, expires_in, scope</text><line x1=\"1347\" y1=\"475\" x2=\"79\" y2=\"475\" class=\"messageLine0\" data-et=\"message\" data-id=\"i8\" data-from=\"API\" data-to=\"App\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-arrowhead)\" style=\"fill: none;\"></line><text x=\"710\" y=\"490\" text-anchor=\"middle\" dominant-baseline=\"middle\" alignment-baseline=\"middle\" class=\"messageText\" dy=\"1em\" style=\"font-family: &quot;Redocly Mermaid Sans&quot;, Arial, &quot;Liberation Sans&quot;, Arimo, Helvetica, &quot;Redocly Mermaid CJK&quot;, sans-serif; font-size: 16px; font-weight: 400;\">API calls with Authorization Bearer access_token</text><line x1=\"76\" y1=\"521\" x2=\"1344\" y2=\"521\" class=\"messageLine0\" data-et=\"message\" data-id=\"i9\" data-from=\"App\" data-to=\"API\" stroke-width=\"2\" stroke=\"none\" marker-end=\"url(#diagram-6c05376ee93e64f755629a24820818850f07a4fda82e4160937c8ff439cfcc53-arrowhead)\" style=\"fill: none;\"></line></svg>"},"children":["sequenceDiagram\n    participant App as Your app\n    participant Browser as User browser\n    participant Consent as app.iclosed.io/oauth/authorize\n    participant API as public.api.iclosed.io\n\n    App->>Browser: Redirect to consent URL with client_id, redirect_uri, scope, PKCE challenge\n    Browser->>Consent: User opens authorize link\n    Consent->>Browser: Login (if needed) + consent screen\n    Browser->>Consent: User clicks Allow access\n    Consent->>API: GET /v1/oauth/authorize (session JWT)\n    API->>Browser: Redirect to redirect_uri?code=...&state=...\n    Browser->>App: Callback with authorization code\n    App->>API: POST /v1/oauth/token (code + code_verifier)\n    API->>App: access_token, refresh_token, expires_in, scope\n    App->>API: API calls with Authorization Bearer access_token\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"step-1--send-the-user-to-the-consent-screen","__idx":11},"children":["Step 1 — Send the user to the consent screen"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Redirect the user's browser to:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"https://app.iclosed.io/oauth/authorize\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Include these query parameters:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Parameter"},"children":["Parameter"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Required"},"children":["Required"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Must be ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ocl_…"]}," client ID."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["One of your registered redirect URIs."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["No"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Space-delimited scopes to request. Must be a subset of your client's allowed scopes. If omitted, all allowed scopes are requested."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["state"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Recommended"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Opaque value returned unchanged on redirect — use it to prevent CSRF."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code_challenge"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes for public clients"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["PKCE challenge (see below)."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code_challenge_method"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes when challenge is sent"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Must be ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["S256"]},"."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Example (public client with PKCE):"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"https://app.iclosed.io/oauth/authorize\n  ?response_type=code\n  &client_id=ocl_rG0xAZ2yRda3Yhhr8v3wf-rOEdhuZdq6\n  &redirect_uri=https://yourapp.example.com/oauth/callback\n  &scope=contacts:read%20contacts:write\n  &state=random-state-value\n  &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM\n  &code_challenge_method=S256\n"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"step-2--user-signs-in-and-approves-access","__idx":12},"children":["Step 2 — User signs in and approves access"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the user is not signed in, iClosed shows the login screen first. After authentication, the consent screen lists the app name, logo, and requested permissions."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/oauth-consent-screen.b10119a664d28cd051364a8904e1322cc7f9a7ca01f7064ef154f2aad516e7f7.9c1bb791.png","alt":"OAuth consent screen showing pending approval banner and Contacts read/write permissions.","framed":false,"withLightbox":false},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["pending"]}," clients, a yellow banner explains that only users in the registering workspace can connect for now."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The user can ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Allow access"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Deny"]},". On allow, iClosed shows a brief confirmation and redirects back to your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]},"."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/oauth-access-granted.e1c54495089e55b7a1f28611e36cc5df6ff04fafc0cd4757a52fe289817c7ed2.9c1bb791.png","alt":"Access granted confirmation showing connected workspace, app name, scopes, and token expiry.","framed":false,"withLightbox":false},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"step-3--receive-the-authorization-code","__idx":13},"children":["Step 3 — Receive the authorization code"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["iClosed redirects the browser to your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}," with:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"https://yourapp.example.com/oauth/callback\n  ?code=AUTHORIZATION_CODE\n  &state=random-state-value\n"},"children":[]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["state"]}," matches what you sent."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The authorization code is short-lived (",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["10 minutes"]},") and single-use."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If the user denied access, the redirect includes ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["error=access_denied"]}," instead of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"step-4--exchange-the-code-for-tokens","__idx":14},"children":["Step 4 — Exchange the code for tokens"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Send a server-side ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST"]}," request to the token endpoint:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"POST https://public.api.iclosed.io/v1/oauth/token\nContent-Type: application/json\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authorization code grant (public client):"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"grant_type\": \"authorization_code\",\n  \"code\": \"AUTHORIZATION_CODE_FROM_CALLBACK\",\n  \"redirect_uri\": \"https://yourapp.example.com/oauth/callback\",\n  \"client_id\": \"ocl_rG0xAZ2yRda3Yhhr8v3wf-rOEdhuZdq6\",\n  \"code_verifier\": \"YOUR_PKCE_CODE_VERIFIER\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authorization code grant (confidential client):"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Authenticate with HTTP Basic auth (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id:client_secret"]},") ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["or"]}," include credentials in the JSON body:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"grant_type\": \"authorization_code\",\n  \"code\": \"AUTHORIZATION_CODE_FROM_CALLBACK\",\n  \"redirect_uri\": \"https://yourapp.example.com/oauth/callback\",\n  \"client_id\": \"ocl_…\",\n  \"client_secret\": \"YOUR_CLIENT_SECRET\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you used PKCE on ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/authorize"]},", include ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code_verifier"]}," even for confidential clients."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Successful response:"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"access_token\": \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...\",\n  \"token_type\": \"Bearer\",\n  \"expires_in\": 3600,\n  \"refresh_token\": \"kN9b-4wFQxQXoXr3Jra6D2xSAn8YvXSVF0yP9fvQX1A\",\n  \"scope\": \"contacts:read contacts:write\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Store the refresh token securely. Access tokens expire after ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["1 hour"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"step-5--call-the-api","__idx":15},"children":["Step 5 — Call the API"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the access token like an API key:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"Authorization: Bearer <access_token>\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Example:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"curl \"https://public.api.iclosed.io/v1/contacts/detail?email=jane@example.com\" \\\n  -H \"Authorization: Bearer ACCESS_TOKEN\" \\\n  -H \"Content-Type: application/json\"\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The token is scoped to the workspace the user selected during authorization and limited to the granted scopes."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"step-6--refresh-expired-access-tokens","__idx":16},"children":["Step 6 — Refresh expired access tokens"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["expires_in"]}," has passed, exchange the refresh token for a new pair:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"grant_type\": \"refresh_token\",\n  \"refresh_token\": \"YOUR_REFRESH_TOKEN\",\n  \"client_id\": \"ocl_…\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For confidential clients, also send ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_secret"]}," (or use Basic auth). iClosed rotates refresh tokens — save the new ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["refresh_token"]}," from each response and stop using the old one."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"pkce-public-clients","__idx":17},"children":["PKCE (public clients)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Public clients ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["must"]}," use ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://datatracker.ietf.org/doc/html/rfc7636"},"children":["PKCE"]},". Generate a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code_verifier"]}," (43–128 random URL-safe characters), then derive the challenge:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"javascript","header":{"controls":{"copy":{}}},"source":"// Node.js example\nimport { createHash, randomBytes } from 'crypto';\n\nconst codeVerifier = randomBytes(32).toString('base64url');\nconst codeChallenge = createHash('sha256')\n  .update(codeVerifier)\n  .digest('base64url');\n","lang":"javascript"},"children":[]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Store ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["codeVerifier"]}," in the user's session (or your server session)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Send ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code_challenge"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code_challenge_method=S256"]}," on the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/oauth/authorize"]}," URL."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Send ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code_verifier"]}," when calling ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v1/oauth/token"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the verifier does not match the challenge, token exchange returns ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["invalid_grant"]},"."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"revoking-access","__idx":18},"children":["Revoking access"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"user-revokes-from-iclosed","__idx":19},"children":["User revokes from iClosed"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Users can disconnect an app from ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Developer → Connected apps"]},": click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Revoke"]}," on one connection, or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Revoke all"]}," for every connection to that app. After revocation, existing tokens stop working and the app has to ask for access again."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"app-revokes-programmatically","__idx":20},"children":["App revokes programmatically"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Call the revocation endpoint:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"POST https://public.api.iclosed.io/v1/oauth/revoke\nContent-Type: application/json\n\n{\n  \"token\": \"ACCESS_OR_REFRESH_TOKEN\",\n  \"token_type_hint\": \"refresh_token\",\n  \"client_id\": \"ocl_…\"\n}\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Confidential clients must authenticate with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_secret"]},". The endpoint is idempotent."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"security-best-practices","__idx":21},"children":["Security best practices"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Use the minimum scopes"]}," needed for your integration."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Never expose client secrets"]}," in browser or mobile code — use a public client with PKCE instead."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Always validate ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["state"]}]}," on the callback to prevent CSRF."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Store refresh tokens encrypted"]}," on your server."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Use HTTPS redirect URIs"]}," in production."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Rotate credentials"]}," if a secret or refresh token is leaked — revoke old tokens immediately."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Request production approval"]}," from ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://app.iclosed.io/support"},"children":["iClosed Support"]}," before listing your integration to customers outside your workspace."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"see-also","__idx":22},"children":["See also"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/authentication"},"children":["Authentication"]}," — API keys (alternative to OAuth for single-workspace server integrations)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/rate-limiting"},"children":["Rate Limiting"]}," — OAuth token requests count toward the same rate limits as API keys"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/errors"},"children":["Errors"]}," — HTTP and application error reference"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://developer.iclosed.io/openapi/v1/oauth"},"children":["OAuth API Reference"]}," — Full endpoint schemas"]}]}]},"headings":[{"value":"OAuth Clients","id":"oauth-clients","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Where to find OAuth Clients","id":"where-to-find-oauth-clients","depth":2},{"value":"Register an OAuth client","id":"register-an-oauth-client","depth":2},{"value":"App details","id":"app-details","depth":3},{"value":"Grant types","id":"grant-types","depth":3},{"value":"Allowed scopes","id":"allowed-scopes","depth":3},{"value":"Client type","id":"client-type","depth":3},{"value":"After registration","id":"after-registration","depth":2},{"value":"Pending approval (important)","id":"pending-approval-important","depth":3},{"value":"How the OAuth flow works","id":"how-the-oauth-flow-works","depth":2},{"value":"Step 1 — Send the user to the consent screen","id":"step-1--send-the-user-to-the-consent-screen","depth":3},{"value":"Step 2 — User signs in and approves access","id":"step-2--user-signs-in-and-approves-access","depth":3},{"value":"Step 3 — Receive the authorization code","id":"step-3--receive-the-authorization-code","depth":3},{"value":"Step 4 — Exchange the code for tokens","id":"step-4--exchange-the-code-for-tokens","depth":3},{"value":"Step 5 — Call the API","id":"step-5--call-the-api","depth":3},{"value":"Step 6 — Refresh expired access tokens","id":"step-6--refresh-expired-access-tokens","depth":3},{"value":"PKCE (public clients)","id":"pkce-public-clients","depth":2},{"value":"Revoking access","id":"revoking-access","depth":2},{"value":"User revokes from iClosed","id":"user-revokes-from-iclosed","depth":3},{"value":"App revokes programmatically","id":"app-revokes-programmatically","depth":3},{"value":"Security best practices","id":"security-best-practices","depth":2},{"value":"See also","id":"see-also","depth":2}],"frontmatter":{"seo":{"title":"OAuth Clients"}},"lastModified":"2026-10-05T19:08:13.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/oauth-clients","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}