> ## Documentation Index
> Fetch the complete documentation index at: https://docs.notifique.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Quick Start

> From app registration to your first API call with an access token — dashboard or API.

<Tip>
  Goal: **register the app → user approves in the browser → call `/v1` with a Bearer token**. Prefer a UI? Start at **Developer → OAuth Apps**.
</Tip>

## In short

* **OAuth client** = your app registration (name, redirect, scopes).
* **PKCE** = extra browser-flow protection (required).
* **Access token** = \~15 min JWT badge; **refresh token** = renew without a new login.

Context: [Introduction](/en/oauth-api/como-funciona/introducao) · [Scopes](/en/oauth-api/como-funciona/escopos)

## Before you start

* Notifique account with access to the target workspace
* Exact **redirect URI** (e.g. `https://myapp.com/oauth/callback`)
* Minimum scope (e.g. `email:send` to test email)
* Base URL: `https://api.notifique.dev`

***

## 1. Register the client

#### 1A, Dashboard

1. **Developer → OAuth Apps → Create app**
2. Name, redirect URIs, scopes
3. Copy **Client ID** and **Client Secret** (secret shown once)

#### 1B, API

```http theme={null}
POST /oauth/register
Content-Type: application/json
```

```json theme={null}
{
  "client_name": "My App",
  "redirect_uris": ["https://myapp.com/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "client_secret_basic",
  "scope": "email:send"
}
```

Expected: **201** with `client_id` and, if confidential, `client_secret`.

***

## 2. PKCE and browser authorization

Generate `code_verifier`, `code_challenge` (S256), and `state`. Open in the browser:

```
https://api.notifique.dev/oauth/authorize
  ?client_id=YOUR_CLIENT_ID
  &response_type=code
  &redirect_uri=https://myapp.com/oauth/callback
  &scope=email:send
  &state=RANDOM
  &code_challenge=CHALLENGE
  &code_challenge_method=S256
```

Exchange the `code` quickly — it expires in minutes.

***

## 3. Exchange code for tokens

```http theme={null}
POST /oauth/token
Content-Type: application/x-www-form-urlencoded
Authorization: Basic BASE64(client_id:client_secret)
```

```
grant_type=authorization_code
&code=CODE
&redirect_uri=https://myapp.com/oauth/callback
&code_verifier=VERIFIER
```

Expected: **200** with `access_token`, `refresh_token`, `expires_in` (\~900).

***

## 4. Call the API

```http theme={null}
POST /v1/email/messages
Authorization: Bearer eyJ...
Content-Type: application/json
```

```json theme={null}
{
  "from": "Support <noreply@yourdomain.com>",
  "to": ["customer@example.com"],
  "subject": "Hello via OAuth",
  "text": "First send with OAuth 2.1."
}
```

Expected: **200** — message queued. The `from` domain must be verified (same as API key flow).

***

## After the first request

* **Refresh:** `POST /oauth/token` with `grant_type=refresh_token` — always save the **new** refresh token
* **Revoke:** `POST /oauth/revoke` or **Connected apps** in the dashboard
* **Details:** [Technical guide](/en/oauth-api/como-funciona/guia-tecnico-cliente) · OpenAPI under **More**