OAuth

This section explains how to set up an OAuth 2.0 authorization flow with Ellipsis Drive.

OAuth allows your application to obtain delegated access to a user’s account without handling their credentials directly.

The flow results in:

• an access token (used to make API requests)

• a refresh token (used to obtain new access tokens over time)

---

Supported flow

Ellipsis Drive supports the Authorization Code grant type, with optional PKCE for enhanced security.

PKCE is recommended for:

• single-page applications

• mobile apps

• native applications

---

Setup steps

1. Register your application

Go to Account settings → Developer settings and register a new OAuth client.

You will need to provide:

• a callback URL (redirect URI)

After registration, store your:

• client ID

• client secret

2. Redirect user to authorization endpoint

In your application, direct the user to the authorization endpoint.

This will redirect the user to Ellipsis Drive, where they can grant access to your application.

3. Receive authorization code

After the user grants access, they are redirected back to your callback URL.

The callback request will include an authorization code as a parameter.

4. Exchange code for tokens

Your backend should exchange the authorization code for:

• an access token

• a refresh token

Store the refresh token securely in your backend so you can create another access token for the user at a later time if needed.

5. Use the access token

Use the access token to make authenticated requests to the Ellipsis Drive API.

6. Refresh tokens when needed

When the access token expires, use the refresh token to obtain a new access token.

This allows users to stay connected without re-authorizing.

---

Important considerations

• Access tokens are short-lived and should not be stored long-term

• Refresh tokens should be stored securely on the backend

• Do not expose tokens in client-side code or URLs