OAuth 2.0

Let a third-party app sign users in with their 36Blocks account using the OAuth 2.0 authorization-code flow (with PKCE).

  1. Send the user to Authorize to validate the request and show the consent screen.
  2. The signed-in user approves with Authorize Decision.
  3. Your app exchanges the code at Token for access and refresh tokens.
  4. Call User Info with the access token to read the user's identity. The fields returned depend on the granted scopes.
  5. Revoke ends a user's grant.

Token and error responses on this page follow OAuth conventions (plain JSON, HTTP 400 for errors), not the standard envelope.

GET
Validate Authorization Request
POST
Submit Authorization Decision
POST
Exchange OAuth Token
GET
Get OAuth User Info
POST
Revoke OAuth Grant

OAuth 2.0 Integration Overview

Dashboard setup

Consent screen