Partners

Registering an OAuth App

1. Go to the Partner dashboard and click "New OAuth App".
2. Enter your app name, description, and website URL.
3. Add one or more redirect URIs (these must be HTTPS in production).
4. Save your client ID and client secret securely.

Authorization Flow

Apertur uses the standard OAuth 2.0 Authorization Code flow. Redirect your users to:

https://apertur.ca/oauth/authorize?
  client_id=your_client_id&
  redirect_uri=https://your-app.com/callback&
  response_type=code&
  scope=sessions:write destinations:read&
  state=random_csrf_token

Token Exchange

After the user authorises your app, exchange the authorization code for an access token:

curl -X POST https://api.apertur.ca/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "client_id": "your_client_id",
    "client_secret": "your_client_secret",
    "code": "auth_code_from_callback",
    "redirect_uri": "https://your-app.com/callback"
  }'

Using the Access Token

Include the access token in the Authorization header of all API requests made on behalf of the user. Tokens expire after 1 hour — use the refresh token to obtain a new one.

Authorization: Bearer oat_xxxxxxxxxxxx

Public Key

Each OAuth app gets a unique public key (format: aptr_live_pk_...). This key is safe to expose in frontend code and is used to initialize the SDK. You can find it in your OAuth app settings.

Allowed Domains

Restrict which domains can use your public key by configuring allowed domains. Wildcards are supported: *.example.com matches any subdomain including nested ones (e.g. app.example.com, staging.app.example.com). Leave empty during development to allow all origins.

Installation

<script src="https://cdn.apertur.ca/sdk/aptr-connect.js"></script>

Usage

<script>
  AptrConnect.init({ publicKey: "aptr_live_pk_your_key_here" });

  document.getElementById("connect-btn").addEventListener("click", () => {
    AptrConnect.authorize({
      scopes: ["upload:create", "project:read"],
      onSuccess: (result) => {
        // Send result.code to your backend to exchange for a token
        console.log("Authorization code:", result.code);
      },
      onError: (err) => console.error(err),
    });
  });
</script>