If your developer is building an application that needs to connect to Loft47, you’ll first need to request an OAuth application from Loft47 Support.

The setup has three parts:

• You: Request the OAuth application and provide the required information.
• Loft47 Development: Creates the application and provides the Client ID and Client Secret.
• Your developer: Uses these credentials to configure the connection and set up the Redirect URI.

1. Request an OAuth Application

Contact Loft47 Support to request an OAuth application for your integration.

Please provide:

• Name of the Loft47 user who will be using the OAuth application
• Email address of that user
• The name or purpose of the application/integration

The name and email address help us identify which Loft47 user will authorize and use the OAuth connection.

Once the application has been created, your Client ID and Client Secret will be provided to you securely for your developer to configure the integration.

🔐 Keep your Client Secret secure

Your Client Secret is sensitive information. Do not send it by email or share it through an unsecured method.

If your Client Secret has already been exposed or lost, contact Loft47 Support so it can be regenerated.

2. Configure and Authorize the Application

Once your developer has configured the application with the Client ID, Client Secret, and Redirect URI, they will confirm when the application is ready for authorization.

Important: Check the Redirect URI

Your developer will configure the Redirect URI for the application.

If urn:ietf:wg:oauth:2.0:oob appears in the Redirect URI list, remove it or move your developer's actual callback URL to the top of the list.

The Authorization URL Preview uses the first Redirect URI in the list. If the oob URI is first, clicking Authorize may lead to a broken page.

Authorize the Application

Once your developer confirms the application is ready:

1. Open the Authorization URL Preview: https://app.loft47.com/oauth/authorize
2. Log in to Loft47 using the account that should authorize the application.
3. Review the authorization request.
4. Click Authorize.

The application will operate using the permissions of the Loft47 user who authorized it.

⚠️ Important: Use the correct Loft47 account

Make sure you are logged in with the correct Loft47 account before clicking Authorize. The application will have access based on the permissions of the user who authorizes it.

For Your Developer

Loft47 uses the OAuth 2.0 Authorization Code flow.

Your developer will need:

• Client ID
• Client Secret
• Redirect URI
• Authorization endpoint: https://app.loft47.com/oauth/authorize
• Token endpoint: https://api.loft47.com/oauth/token

The token endpoint is used to exchange the authorization code for tokens and to handle refresh token requests.

The Client Secret should be stored securely on the developer's server and should never be exposed in the browser or included in the authorization URL.

⚠️ Important: A Loft47 user must authorize the application

Loft47 does not support connecting an application using only the Client ID and Client Secret (also known as the Client Credentials flow).

Instead, the application must use the Authorization Code flow. This means a Loft47 user needs to log in and authorize the application before the connection can be established.