Skip to main content
To write on a user’s behalf or read their information you need that user’s consent. Rocketpunch handles this with the OAuth 2.0 Authorization Code + PKCE flow.

​
The model at a glance

​
Endpoints

These are split across two hosts: where you send the user’s browser, and where your servers exchange tokens.
The consent screen is on the developer console host (developers.rocketpunch.com), while token issuance is on the API host (openapi.rocketpunch.com). This is a common mix-up — double-check it.

​
Scopes

Two permissions can be granted today. Requested scopes are granted or denied together. Users cannot pick a subset. Calling /oauth/userinfo requires profile, and including the email in the response requires email as well.
Consent for additional scopes is currently available to app owners only. Support for general users will be expanded later.
If the user’s existing consent is still valid and already covers everything you are requesting, the flow passes straight through. The screen reappears when:
  • the user is connecting for the first time
  • you request broader permissions than before
  • the consent has expired or its terms changed

​
Working with tokens

Access tokens expire after 15 minutes. Use the refresh token to get a new one. Refresh tokens are replaced with a new value on every use. Always store the new refresh token from the response and discard the old one — reusing the old value fails.

​
Next steps

Integrate OAuth

From generating PKCE values to exchanging tokens and calling the API, with real code.