Build an OAuth app
OAuth apps are in private preview. Contact us to get access and a full integration guide.
Stedi apps are integrations between Stedi and your system. Customers install your app from the Stedi app directory to connect their Stedi account to your platform.
OAuth apps use OAuth 2.1, the industry-standard authorization protocol, to automate this connection. Your customer authorizes your app once, and your app receives its own credentials to operate in their account.
Benefits
OAuth apps simplify customer onboarding and reduce manual configuration work.
- One-click install: You share an install link or embed the link in your platform. Your customers create a Stedi account, review what your app can access, and approve. For example, your app can request read and write access to send eligibility checks.
- Self-service provisioning: Once authorized, your app calls Stedi APIs with its own token to set up what it needs in the customer's account: creating event destinations, creating SFTP users, running eligibility checks, and managing enrollments.
- Direct login for support: Your support and engineering staff can open a temporary, badged, audited session in an installed customer's account to help them troubleshoot.
How it works
OAuth apps use standard OAuth 2.1 authorization code flow with Proof Key for Code Exchange (PKCE) without Stedi-specific extensions. If you've integrated with a Stripe or Shopify app, the flow is familiar, and any standard OAuth client library works.
In the Stedi portal, provide a name, logo, description, support URL, and one or more redirect Uniform Resource Identifiers (URIs). Stedi returns a client_id and a client_secret.
Redirect the customer's browser to Stedi's authorize endpoint with your client_id, redirect URI, state, and PKCE code_challenge. Stedi handles sign-in, sign-up, and the consent screen.
Stedi redirects to your registered redirect URI with an authorization code. Verify that state matches what you stored, then exchange the code for tokens within 60 seconds.
Send the access token as Authorization: Bearer <access_token>. The response includes the stedi_account_id for the connection.
Access tokens last one hour, and refresh tokens last a year. The clock resets on every use, so an app that refreshes regularly stays connected without periodic re-authorization.
Stedi also delivers app.installed and app.uninstalled events to your own Stedi account, so you know when a customer connects or disconnects without polling. Customers can uninstall at any time, and your app's access ends shortly after.
Get started
Contact us for the full integration guide, which covers creating the app, the exact authorize and token requests, error handling, and client secret rotation. Our teams work directly with yours through your first integration.