Authentication
Every Offri API request is authenticated with a bearer token in the Authorization header:
curl https://api.offri.app/v1/proposals \
-H "Authorization: Bearer your_token_here"
The token determines which organisation (workspace) the request is scoped to and which permissions it has. There are two ways to obtain one:
- An API key, for integrations you build for your own organisation.
- OAuth, for third-party apps that connect to their users' organisations.
API key
You can find your API key in the Offri app under your organisation settings, in the Integrations tab. The key is tied to that organisation and carries the scopes it was created with.
OAuth
OAuth allows for a more seamless and secure integration experience by guiding the user through logging in and granting scopes. During authorization the user logs in, picks which organisation your app may access, and approves the requested scopes. Use this if you're a third party integrating with Offri.
Registering a client
There are two ways to get an OAuth client:
- Contact us to register a verified client for your integration.
- Self-register through Dynamic Client Registration (RFC 7591): POST your client metadata to the
registration_endpointlisted in the discovery document. Self-registered clients are personal connections and show an "unverified app" notice on the consent screen.
Authorizing
Run the standard authorization-code flow:
| Endpoint | URL |
|---|---|
| Discovery | https://offri.app/.well-known/openid-configuration |
| Authorization | https://offri.app/oauth2/auth |
| Token | https://offri.app/oauth2/token |
Request the offline_access scope to also receive a refresh token.
Scopes
Scopes follow a resource:read / resource:write naming scheme (for example proposals:read or clients:write). Each endpoint in this reference lists the scope it requires under its Authorization section.