Skip to main content
OAuth is a borrowed badge: the user signs in to Notifique, picks a workspace, and authorizes what your app can do — without sharing an API key or password.

​
What is OAuth on Notifique?

It is how third-party apps, browser integrations, and AI hosts (ChatGPT, Claude, Gemini) call the API on behalf of a user. Notifique runs an OAuth 2.1 Authorization Server at https://api.notifique.dev, with mandatory PKCE and Dynamic Client Registration (DCR). You can:
  • Connect a SaaS where each customer uses their own Notifique account
  • Authorize CLIs and local apps with browser consent
  • Integrate MCP in AI assistants with automatic login
  • Limit permissions by scope — same as an API key, but user-approved
  • Refresh access without asking the user to log in again
  • Revoke from the dashboard or API when the customer disconnects
Think of an API key as the building master key. OAuth is the visitor who checks in at reception and gets a temporary badge.
API keys (sk_live_… / sk_test_…) remain valid for CI, cron, headless Cursor, and your own backends. Use OAuth when someone else must authorize through the browser.

​
When to use it

For direct sends from your server, start with API keys.

​
How it works in practice

  1. Register the client — Developer → OAuth Apps or POST /oauth/register
  2. Redirect the user to /oauth/authorize with PKCE (code_challenge S256)
  3. They sign in, pick a workspace, and approve scopes
  4. Your app exchanges the code at /oauth/token with code_verifier
  5. Call /v1/* with Authorization: Bearer <access_token>
Issuer: https://api.notifique.dev
The consent screen lives in the Notifique dashboard. Your app only opens the URL in the browser and handles the callback.

​
What you can do

  • Register web, mobile, or CLI clients (public or confidential)
  • Request scopes per channel (email:send, whatsapp:send, …)
  • Get JWT access tokens (~15 min) + rotating refresh tokens
  • Validate JWTs offline via GET /.well-known/jwks.json
  • Revoke under Settings → Team → Connected apps or POST /oauth/revoke
Endpoint details: OpenAPI reference under the More tab.

​
Next steps