OAuth apps

Stedi apps are integrations between Stedi and your system. Customers install your app from an install link that you share directly or embed in your platform.

OAuth apps use OAuth 2.1, the industry-standard authorization protocol, to automate this connection. Your customer authorizes your app once, and your app receives its own credentials to operate in their account.

Benefits

OAuth apps simplify customer onboarding and reduce manual configuration work.

• One-click install: You share an install link or embed the link in your platform. Your customers create a Stedi account, review what your app can access, and approve. For example, your app can request read and write access to send eligibility checks.
• Self-service provisioning: Once authorized, your app calls Stedi APIs with its own token to set up what it needs in the customer's account: creating event destinations, creating SFTP users, running eligibility checks, submitting claims, and managing enrollments.
• Direct login for support: Your support and engineering staff can open a temporary, badged, audited session in an installed customer's account to help them troubleshoot.

How it works

OAuth apps use standard OAuth 2.1 authorization code flow with Proof Key for Code Exchange (PKCE) without Stedi-specific extensions. You can use any OAuth client library to build your app.

1

Register your app.

In the Stedi portal, provide a name, logo, description, support URL, and one or more callback URLs. Stedi issues your app's credentials. Your app starts in development mode, where it stays unlisted and supports at most 5 active installs.

2

Generate install links and handle callbacks.

Generate an install link for each customer and write a handler for the callback. Stedi handles sign-up and the consent screen, then redirects to your callback URL with an authorization code. Your app exchanges that code for a bearer access token, which it uses to call Stedi APIs.

3

Build app functionality.

Your app does work in a customer's account by calling Stedi APIs. For example, to run an eligibility check, your app sends the request with the bearer access token in place of an API key.

Your app periodically refreshes the access token to stay connected, so customers don't have to re-authorize.

4

Go live.

Submit your app for review. Once Stedi approves it, switch your app to live mode to lift the install limit. You can also choose to list your app on the Stedi Apps page.

Stedi delivers app.installed and app.uninstalled events to your own Stedi account, so you know when a customer connects or disconnects without polling. Customers can uninstall at any time, and your app's access ends shortly after.

Support sessions

Staff who have the admin or developer role in your Stedi account can open a session in any customer account with your app installed, without asking for credentials or an invitation. The session includes your app's permissions, so your team can troubleshoot directly in the customer's account. Visit Log in to customer accounts for instructions.

Limitations

Keep the following in mind as you plan your integration:

• Customers can only install apps in new Stedi accounts.
• When a customer uninstalls your app, Stedi deletes the SFTP connection and SFTP users your app created. Other resources remain in the account until someone removes them manually. Stedi labels these resources as managed by your app.

Get started

Visit Build an OAuth app for the full integration guide, which covers registering the app, the exact authorize and token requests, error handling, and client secret rotation. Stedi works with you through your first integration.