---
title: "OAuth authorize URL (browser redirect, not an API request)"
method: GET
path: "/oauth"
tags: ["oauth"]
---

# OAuth authorize URL (browser redirect, not an API request)

`GET /oauth`

## Request

- Base URL: `https://app.formify.eu`
- URL: `https://app.formify.eu/oauth`
- Auth: none required

> **This is not a REST endpoint.** Redirect the user's browser to this URL — do not call it as a server-to-server API request.

### Step 1: Requesting authorization

First, redirect the customer's web browser to the authorize endpoint. Formify will send the customer to the Formify app to authorize your app to access their Formify account.

**Authorize URL:**
```
GET https://docs-api.formify.eu/v1/oauth/authorize?client_id={client_id}&redirect_uri={redirect_uri}&response_type=code&scope=read%20write&state={state}
```

**Parameters:**

| Parameter       | Required | Description                                                                                           |
|-----------------|----------|-------------------------------------------------------------------------------------------------------|
| `client_id`     | Yes      | The client ID provided to you by Formify when you register your app.                                  |
| `redirect_uri`  | Yes      | The callback URL you provided when you registered your app. This should be URL-encoded.               |
| `response_type` | Yes      | Must be `code`.                                                                                       |
| `scope`         | Yes      | Requested access scope. One of `read`, `write`, or `read write` (space-separated).                   |
| `state`         | Recommended | Strongly recommended for CSRF protection. Send a random value and verify that the same value is returned to your callback.  |

**Example of URL-encoded redirect_uri:**
https%3A%2F%2Fwww.your-domain.com%2Foauth%2Fcallback

### Step 2: Customer Authorizes the App

The customer will see a confirmation dialog. If they authorize, they will be redirected to the callback URL with a code parameter:

```
GET https://your-callback-url.com?code={authorization_code}&state={state}
```

### Step 3: Exchange Authorization Code for Access Token

Make a `POST` request to `/oauth/token` through the API to exchange the authorization code for an access token and refresh token. The refresh token is normally valid for 60 days.

**Request:**

```
POST https://docs-api.formify.eu/v1/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code={authorization_code}&client_id={client_id}&client_secret={client_secret}&redirect_uri={redirect_uri}
```

**Response:**

```
{
  "access_token": "{access_token}",
  "expires_in": 3600,
  "refresh_token": "{refresh_token}",
  "token_type": "Bearer",
  "scope": "read write"
}
```

## Query parameters

- `client_id` string, required
- `state` string
- `redirect_uri` string, required
- `response_type` 'code', required
- `scope` 'read' | 'write' | 'read write', required
- `errorLanguage` 'en' | 'sv' | 'es'

## Other responses

- `302`: Redirection to the provided `redirect_uri` with the authorization code as a query parameter.

---

[API](https://skmtc.dev/formify/apis/formify-api.md) · [All operations](https://skmtc.dev/formify/apis/formify-api/llms.txt) · [OpenAPI document](https://skmtc.dev/formify/apis/formify-api/revisions/571c4c0d4f4f?raw)