GETTING STARTED

OAuth 2.0

1) Send the user to the consent page with your client_id, a registered redirect_uri, the scopes you need and a code_challenge.

2) After approval we redirect back to your redirect_uri with code and state.

3) Exchange the code for tokens with POST /oauth/token. Public clients (mobile/browser) send code_verifier; server apps send client_secret.

Apps in “development” only work for your own account. Submit for review in the console to open it to everyone.

← Authentication Rate limits & errors →

Request

# 1. Authorize (open in the user's browser)
https://app.cloudilx.com/oauth/authorize?client_id=cx_app_…&redirect_uri=https%3A%2F%2Fyourapp.com%2Fcallback&scope=files.read%20files.write&state=xyz&code_challenge=…&code_challenge_method=S256

# 3. Exchange the code
curl -X POST https://api.cloudilx.com/oauth/token \
  -d grant_type=authorization_code \
  -d code=AUTH_CODE \
  -d redirect_uri=https://yourapp.com/callback \
  -d client_id=cx_app_… \
  -d code_verifier=VERIFIER

Response

{
  "access_token": "cxo_…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "cxor_…",
  "scope": "files.read files.write"
}