OAuth for partners

OAuth lets an approved partner app connect on a customer’s behalf. If you are connecting your own backend to your own account, use an API key instead.

Authorization flow

Infinite Audience uses the OAuth 2.0 authorization-code flow with PKCE (S256).

Send the customer to GET /v1/oauth/authorize with your registered client details and PKCE challenge.
The customer reviews the requested access and approves the connection.
Infinite Audience returns a short-lived authorization code to your registered redirect URL.
Exchange the code and PKCE verifier at POST /v1/oauth/token.
Use the access token for API requests and the refresh token to keep the connection active.

Authorization request

Parameter	Required	Purpose
`client_id`	Yes	Identifies the registered partner app
`redirect_uri`	Yes	Must exactly match an approved redirect URL
`response_type`	Yes	Use `code`
`scope`	No	Space-separated access requested from the customer
`code_challenge`	Yes	PKCE challenge derived from your verifier
`code_challenge_method`	Yes	Use `S256`
`state`	Recommended	Lets your app validate the returning request

Token exchange

curl -X POST https://api.infiniteaudience.ai/v1/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=$AUTH_CODE" \
  -d "redirect_uri=$REDIRECT_URI" \
  -d "client_id=$CLIENT_ID" \
  -d "client_secret=$CLIENT_SECRET" \
  -d "code_verifier=$CODE_VERIFIER"

Access tokens last one hour. Refresh tokens last 90 days and can be exchanged at the same endpoint with grant_type=refresh_token. Authorization codes last 60 seconds and can be used once.

Use POST /v1/oauth/revoke when a connection is removed. Customers can also revoke a partner from their account settings, so treat a failed refresh as a cue to reconnect.