As a developer you just need to send users (administrators) to the authentication form, and then request the token from the “redirect url” on your server.

1. Get Authorization Code

To start the OAuth authentication flow, redirect the user’s browser to the following URL. This will open the Onpipeline login page, where the admin user can authenticate and authorize your application.

https://app.onpipeline.com/auth-oauth/?client_id=your_client_id&redirect_url=redirect_url_encoded&state_check=your_id

Parameters:

• client_id → Your application’s client ID.
• redirect_url → The callback URL where the user will be redirected after a successful login.
• state_check (optional) → An alphanumeric string (up to 100 characters) generated by your application. The same value will be returned during the verification step, allowing you to verify that the OAuth flow was initiated by your application and helping protect against CSRF attacks.

Example:

https://app.onpipeline.com/auth-oauth/?client_id=abc123&redirect_url=https%3A%2F%2Fmyapp.xyz&state_check=id123

If the user successfully logs in, the browser will be redirected to the redirect_url you set when the login form was loaded. The code you need to request a Token will be passed to the redirect url in the query string.

Example:

https://redirect_url?code=b157b972475d1f4bdf3c333354b0a506cca23917258f816abe21

The redirect_url must use a fully qualified domain name (FQDN), such as myapp.local, example.com, or app.example.com. As a result, http://localhost and https://localhost are not supported. For local development, you can map a custom local domain to 127.0.0.1 in your system’s hosts file and use that domain as the redirect_url.

2. Get Access Token

After the user has successfully authenticated, their browser will be redirected to your redirect_url with the authorization code as a query string parameter. Your server should exchange the authorization code for an API token by making a server-side request to the following verify URL:

GET/POST https://app.onpipeline.com/auth-oauth/verify

Include the following parameters in the request:

• client_id → Your application’s client ID.
• client_secret → Your application’s client secret.
• code → The authorization code received in the redirect_url query string.

The verify url will respond with a json object like the following:

{
"Client_Id":"your_client_id",
"Token":"426d0e18ea0d1ec1c9ca7e0917280d75e5769a232f6daf38b55c",
"State":"your_id" 
}

* The state_check value, if set, will be returned by the verify URL (State=state_check).

Store the returned Token securely on your server and use it to authenticate all subsequent API requests.

Sample php code for your redirect script:

$client_id = "your_client_id";
$client_secret = "your_client_secret";
$code = $_GET['code'];
$verify_url="https://app.onpipeline.com/auth-oauth/verify";
$verify_url.="?client_id=$client_id&code=$code&client_secret=$client_secret";
$response = file_get_contents($verify_url);

Register as a Developer:

To obtain your client_id and client_secret, please get in touch with support@onpipeline.com