# Veeqo now supports OAuth

**URL:** <https://developer-forum.veeqo.com/t/veeqo-now-supports-oauth/95>\
**Category:** API Queries (How To)\
**Created:** [January 26, 2018, 12:59pm UTC](https://developer-forum.veeqo.com/t/veeqo-now-supports-oauth/95 "2018-01-26T12:59:52Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![phil](https://yyz1.discourse-cdn.com/flex033/user_avatar/developer-forum.veeqo.com/phil/32/43_2.png) [@phil](https://developer-forum.veeqo.com/u/phil)\
**Post date:** [January 26, 2018, 12:59pm UTC](https://developer-forum.veeqo.com/t/veeqo-now-supports-oauth/95/1 "2018-01-26T12:59:52Z")

</div>

## Veeqo now supports OAuth.

The update has been deployed and is now in a open beta. We’ve completed our initial testing and it all looks to be working well. We still need to update the documentation and there are few manual steps that need to be automated. However it is a much faster and more secure way of authentication for your apps in Veeqo - especially if your application is intended for public use by other Veeqo users.

We need you to give us your feedback on how it works and what we need to improve. Instructions follow.

## OAuth Setup

### 0. Application Set Up

(This is the manual step that will eventually be automated)

Create a redirect\_uri and let us know your application name. We will then send you your client\_id and client\_secret.

### 1. Authorizing the user

_Assuming our application is set up like so:_

- client\_id: 4f8a5d37071f0955e3c8a3dcbf3ff0b53c0699d2085cc6b01707fb3eb9912652

- client\_secret: dd04814c033fdbc9a01a9b68100d359edaa41d8ad702a03ae221dd456da1d59c

- redirect\_uri: [http://example.com/test\_oauth\_callback](http://example.com/test_oauth_callback)

- Redirect the user to the authorize URL on the page that they redirect the user from (marketing site), e.g: [https://api.veeqo.com/oauth/authorize?client\_id=4f8a5d37071f0955e3c8a3dcbf3ff0b53c0699d2085cc6b01707fb3eb9912652&redirect\_uri=http%3A%2F%2Fexample.com%2Ftest\_oauth\_callback&response\_type=code&scope=](https://api.veeqo.com/oauth/authorize?client_id=4f8a5d37071f0955e3c8a3dcbf3ff0b53c0699d2085cc6b01707fb3eb9912652&redirect_uri=http%3A%2F%2Fexample.com%2Ftest_oauth_callback&response_type=code&scope=)

- Get user to authorize the app

### 2. Get authorization code

It is returned in the code param of the redirect uri (e.g. [http://example.com/test\_oauth\_callback?code=acc2658ced4f9eea257c9da72acea1c97f9e1b1db2118b565355532af13591d7](http://example.com/test_oauth_callback?code=acc2658ced4f9eea257c9da72acea1c97f9e1b1db2118b565355532af13591d7)) - this code lasts only 10 minutes

### 3. Make a request for the permanent token

Make a request to `https://api.veeqo.com/oauth/token` using client id, client secret, temporary code, e.g:

Request URL: /oauth/token

Method: POST

_Params:_  
grant\_type: authorization\_code

redirect\_uri: [http://example.com/test\_oauth\_callback](http://example.com/test_oauth_callback)

client id: 4f8a5d37071f0955e3c8a3dcbf3ff0b53c0699d2085cc6b01707fb3eb9912652

client secret: dd04814c033fdbc9a01a9b68100d359edaa41d8ad702a03ae221dd456da1d59c

code: acc2658ced4f9eea257c9da72acea1c97f9e1b1db2118b565355532af13591d7

Should return a response like so:

```auto
{
    "access_token": "82d7b651f3634a5243c4155f8832f09b30de0c115280d0c2ef62512e6bc5312e",
    "token_type": "bearer",
    "created_at": 1510741588
}

```

`access_token` is the token to use in further requests - should be saved permanently!

### 4. Save the access\_token value

This should be saved from the last request

### 5. Make a request

Make a request like normal with our bearer token, e.g.

Request URL: /current\_user

Method: GET

_Headers:_  
Authorization: Bearer 82d7b651f3634a5243c4155f8832f09b30de0c115280d0c2ef62512e6bc5312e

---

<div class="post-metadata">

**Author:** ![phil](https://yyz1.discourse-cdn.com/flex033/user_avatar/developer-forum.veeqo.com/phil/32/43_2.png) [@phil](https://developer-forum.veeqo.com/u/phil)\
**Post date:** [January 26, 2018, 1:00pm UTC](https://developer-forum.veeqo.com/t/veeqo-now-supports-oauth/95/2 "2018-01-26T13:00:40Z")

</div>



---

<div class="post-metadata">

**Author:** ![littlepixiez](https://yyz1.discourse-cdn.com/flex033/user_avatar/developer-forum.veeqo.com/littlepixiez/32/17_2.png) [@littlepixiez](https://developer-forum.veeqo.com/u/littlepixiez)\
**Post date:** [March 23, 2018, 5:10pm UTC](https://developer-forum.veeqo.com/t/veeqo-now-supports-oauth/95/3 "2018-03-23T17:10:33Z")

</div>

Just to say, if you’re a bit of an OAuth noob like myself, you need to post the temporary authorization code in with the parameters too.

> [@sam123](#):
>
> Params:  
> grant\_type: authorization\_code  
> redirect\_uri: [http://webzuo.com/test](http://webzuo.com/test)  
> client id: 4f8a5d37071f0955e3c8a3dcbf3ff0b53c0699d2085cc6b01707fb3eb9912652  
> client secret: dd04814c033fdbc9a01a9b68100d359edaa41d8ad702a03ae221dd456da1d59c

code: acc2658ced4f9eea257c9da72acea1c97f9e1b1db2118b565355532af13591d7  
(from the example above)

---

<div class="post-metadata">

**Author:** ![RetainMeDevs](https://avatars.discourse-cdn.com/v4/letter/r/9B8BFF/32.png) [@RetainMeDevs](https://developer-forum.veeqo.com/u/RetainMeDevs)\
**Post date:** [January 15, 2021, 2:56pm UTC](https://developer-forum.veeqo.com/t/veeqo-now-supports-oauth/95/4 "2021-01-15T14:56:20Z")

</div>

Hi,

This is article was from 2018, I suspect no UI to obtain clientId & clientSecret?

I have a test app, with a sandbox account…Who do I contact to get creds?

Stay Safe,

---

<div class="post-metadata">

**Author:** ![RetainMeDevs](https://avatars.discourse-cdn.com/v4/letter/r/9B8BFF/32.png) [@RetainMeDevs](https://developer-forum.veeqo.com/u/RetainMeDevs)\
**Post date:** [February 9, 2021, 5:37pm UTC](https://developer-forum.veeqo.com/t/veeqo-now-supports-oauth/95/5 "2021-02-09T17:37:30Z")

</div>

Hi @sam123, Reaching out again to understand the next steps. Could I send you our test callback uri and and application name to receive the clientId and clientSecret?

Regards,

---

<div class="post-metadata">

**Author:** ![RetainMeDevs](https://avatars.discourse-cdn.com/v4/letter/r/9B8BFF/32.png) [@RetainMeDevs](https://developer-forum.veeqo.com/u/RetainMeDevs)\
**Post date:** [February 18, 2021, 4:20pm UTC](https://developer-forum.veeqo.com/t/veeqo-now-supports-oauth/95/6 "2021-02-18T16:20:10Z")

</div>

I now have creds! Thank you Laura!

I just wanted to touch into an area that’s not been covered here or in the documentation. A link to OAuth may not help others if it’s buried in nested pages.

**The State object/string** This is absolutely essential to protect against CSRF in the redirect flow. All this means from a developers perspective is to ensure the request came from veeqo, by passing an object or a classic guid string when sending an authorize request.

**Store the state that you created to cross reference later.**

C# Example:

```
var state = Guid.NewGuid().ToString();
string url = $"{OAuthAuthorizeUrl}?response_type={ResponseType}&client_id={ClientId}&redirect_uri={CallbackUri}&state={state}";

```

When the user approves access to veeqo, the callback Uri (redirect Uri) will contain the state string in the query string.

Obtain the state sent from veeqo and cross reference with the state previously stored… They’ll match! and this ensures the request came from veeqo.

Snippet from OAuth best practices:

> Clients MUST prevent Cross-Site Request Forgery (CSRF). In this context, CSRF refers to requests to the redirection endpoint that do not originate at the authorization server, but a malicious third party (see [Section 4.4.1.8. of [RFC6819]](https://tools.ietf.org/html/rfc6819#section-4.4.1.8) for details). Clients that have ensured that the authorization server supports PKCE [[RFC7636](https://tools.ietf.org/html/rfc7636)] MAY rely the CSRF protection provided by PKCE. In OpenID Connect flows, the “nonce” parameter provides CSRF protection. Otherwise, one-time use CSRF tokens carried in the “state” parameter that are securely bound to the user agent MUST be used for CSRF protection (see [Section 4.7.1](https://tools.ietf.org/html/draft-ietf-oauth-security-topics-16#section-4.7.1)).

Further steps can be found here:

> **[OAuth 2.0 Security Best Current Practice](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-16)**
>
> This document describes best current security practice for OAuth 2.0. It updates and extends the OAuth 2.0 Security Threat Model to incorporate practical experiences gathered since OAuth 2.0 was published and covers new threats relevant due to the...

Hopefully the above helps someone that may miss some of the “MUST” steps in security.

Regards,

---

<div class="post-metadata">

**Author:** ![laura](https://yyz1.discourse-cdn.com/flex033/user_avatar/developer-forum.veeqo.com/laura/32/80_2.png) [@laura](https://developer-forum.veeqo.com/u/laura)\
**Post date:** [February 19, 2021, 8:52am UTC](https://developer-forum.veeqo.com/t/veeqo-now-supports-oauth/95/8 "2021-02-19T08:52:05Z")

</div>

Thanks for sharing 😁

---

<div class="post-metadata">

**Author:** ![laura](https://yyz1.discourse-cdn.com/flex033/user_avatar/developer-forum.veeqo.com/laura/32/80_2.png) [@laura](https://developer-forum.veeqo.com/u/laura)\
**Post date:** [April 7, 2021, 9:56am UTC](https://developer-forum.veeqo.com/t/veeqo-now-supports-oauth/95/9 "2021-04-07T09:56:00Z")

</div>