Skip to main content
When you register an app you pick a type that matches the APIs you plan to use. There is one question that decides it: does this need a user to sign in?

​
App Key app

You only read public data. A job search service, an event aggregator, an analytics dashboard — anything that never acts on behalf of a specific user. Send your App Key in the X-RP-API-Key header and you are done. No user sign-in, no consent screen.

​
OAuth client app

To act on a user’s behalf you need that user’s consent. Once they sign in with their Rocketpunch account and grant permission, you receive a token that lets you call the API as that user. You also register a redirect URI — the address users return to after granting consent.
Each app has one redirect URI and it must match character for character. A single trailing slash or an extra query string is enough to get the authorization rejected.

​
Not sure which one?

App Key app. Reading public data does not require a user to sign in.
OAuth client app. The post is authored as a specific user, so you need that user’s consent.
OAuth client app. The profile scope gives you their name and profile information; the email scope gives you their email address.
Register an OAuth client app. It also receives an App Key, so you can keep calling public-data endpoints with the App Key exactly as before.

​
Next steps

App Key authentication

Send your key in a header and manage it safely.

OAuth 2.0 overview

The authorization model, token lifetimes, and available scopes.