App Authorization

This guide covers the OAuth authorization-code flow for vivenu apps.

Authorization flow

Redirect users to authorize your app.
Receive users back on your callback URL with code (+ optional state).
Exchange code for an API key-like access_token.
Optionally redirect users back to your app dashboard page.

Step 1: Request app installation

GET https://dashboard.vivenu.com/oauth2/authorize

Required query params include response_type=code, client_id, redirect_uri.

Step 2: Handle callback

GET https://your-site.com/oauth2/callback

On success, the callback contains code and state.

Step 3: Exchange code for token

POST https://apps.vivenu.com/api/oauth2/token

Required params: grant_type=authorization_code, client_id, client_secret, code, redirect_uri.

Verify marketplace state

When installed via marketplace, verify state with your CLIENT_SECRET.

const expected = createHmac('sha256', CLIENT_SECRET)
  .update(request.query.code)
  .digest('base64url')

if (expected !== request.query.state) {
  throw new Error('State mismatch')
}