OAuth overview

Environment and endpoints

Production issuer is https://accounts.appforges.com; staging is https://accounts-staging.appforges.com. Browser authorization uses the issuer's /oauth2/authorize, and token exchange uses /oauth2/token. Business APIs use the matching API domain. Do not use REST /v1/oauth/authorize as a browser login URL.

Create an OAuth client in application Credentials with Public/Confidential mode, redirect URIs and allowed scopes. Copy the actual client_id; app_id is a different identifier. Public clients use PKCE S256 without client_secret; Confidential secrets stay on secure backends.

User authorization, refresh and service tokens are distinct flows. Start user calls with Authorization Code + PKCE. See Client Credentials for service calls and Refresh Token for refresh.