OAuth2 apps

Build integrations that connect to other people's Brivio organizations with their consent — the standard authorization-code flow with PKCE.

Register your app

In Developers → Apps, register an OAuth app to get a client_id (and a client_secret for confidential clients). Configure your redirect URIs and the scopes you need.

Authorization flow

https://app.brivio.ro/api/oauth/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.com/callback
  &response_type=code
  &scope=invoices:read invoices:write contacts:read
  &state=RANDOM_STATE
  &code_challenge=BASE64URL(SHA256(verifier))
  &code_challenge_method=S256

The user signs in, picks the organization and environment (live or sandbox) to grant, and reviews your requested scopes on the consent screen.

POST https://app.brivio.ro/api/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=AUTH_CODE
&redirect_uri=https://yourapp.com/callback
&client_id=YOUR_CLIENT_ID
&code_verifier=VERIFIER

{
  "access_token": "brivio_at_...",
  "refresh_token": "brivio_rt_...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "invoices:read invoices:write contacts:read"
}

Using tokens

Access tokens work exactly like API keys against https://api.brivio.ro/v1. Refresh tokens rotate on every use — reusing an old refresh token revokes the whole chain (leak protection), so always persist the newest pair.

Grant types

authorization_code (+PKCE) for user-delegated access, refresh_token for rotation, and client_credentials for app-level access to organizations that installed your app.