Pandle implements Oauth2 for authorising third party applications.

Pandle currently supports the authorization code grant flow.

To integrate your application with Pandle contact support@pandle.com to request your application id and secret.

To request the authorisation code, redirect the user to the authorisation endpoint with the following GET parameters:

https://my.pandle.com/oauth/authorize?client_id=APP_ID&redirect_uri=REDIRECT_URI&response_type=code

Where APP_ID is the Application id you received after registering your application and REDIRECT_URI is the exact redirect URI you entered when registering your application.

This will ask the user to approve your application's access to their account and redirect them back to the REDIRECT_URI with the authorisation code as a GET parameter.

https://my-app.example.com/callback?code=1234567890

If the user denies authorisation they will be redirected back to your REDIRECT_URI with the following url params

error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request

To request the access token, make a POST request to

https://my.pandle.com/oauth/token

with the following form-urlencoded parameters

client_id=APP_ID&client_secret=APP_SECRET&code=CODE&grant_type=authorization_code&redirect_uri=REDIRECT_URI

APP_ID is the Application id you received when registering your app,
APP_SECRET is the Secret you received when registering your app,
REDIRECT_URI is the exact uri you entered when registering your application
CODE is the code returned after requesting an authorisation code.

This request will return an access token that can be used to make requests against the API.

To make a request on behalf of a user pass the token in the Authorization header.

curl --header "Authorization: Bearer ACCESS_TOKEN" https://my.pandle.com/api/v1/me

Where ACCESS_TOKEN is the token you received in the previous step.

Example refresh token URL:

APP_ID is the Application id you received when registering your app,
APP_SECRET is the Secret you received when registering your app,
REFRESH_TOKEN is the Refresh token you recieved along with you OAUTH token.