OAuth apps

OAuth lets a third-party app act for a company after an admin approves it. It is not open to third parties yet.

Status: not open yet. App registration is reviewed by OfficeHero and handled by e-mail — see Register an app. To integrate your own systems today, use an Integrations API key.

What it will look like

OfficeHero acts as the authorization server and your app as an OAuth 2.0 client using the authorization code grant:

1. Register your app — name, description, icon, the exact callback URL and the scopes you will ask for. After review you receive a client_id and a one-time client_secret.
2. Send the company admin to OfficeHero with client_id, redirect_uri, scope, state and response_type=code. The admin reviews the scopes and approves.
3. Exchange the code on your server (grant_type=authorization_code, with client_id, client_secret and the same redirect_uri) for an access token bound to that company’s installation of your app.

Codes are single-use and short-lived, and the redirect_uri must match the registered one exactly.

What tokens it issues

OAuth access tokens are oht_… tokens tied to one installation. Today they are accepted by the MCP server only — not by the Integrations API, which accepts oh_live_ API keys alone. When that changes, it will be in the changelog.