DocsOAuth Apps

OAuth Apps

Create secure OAuth applications to integrate third-party services with Syncaty. OAuth provides delegated access without sharing credentials.

Overview

OAuth apps allow external services (like n8n) to access your Syncaty data on your behalf. Each app gets unique credentials and can be granted specific permissions (scopes).

Secure Access

OAuth tokens can be revoked without changing your password. Each integration has separate credentials.

Scoped Permissions

Grant only the permissions each integration needs. Limit access to specific data types.

Creating an OAuth App

  1. Go to Settings → OAuth Apps in your Syncaty dashboard
  2. Click "Create New App"
  3. Enter a descriptive name for the application
  4. Enter the Redirect URI (where users return after authorization)
  5. Click "Create"
  6. Copy and securely store the Client ID and Client Secret

Important

The Client Secret is only shown once during creation. Store it securely. If lost, you'll need to regenerate it.

OAuth Flow

Syncaty uses the standard OAuth 2.0 Authorization Code flow:

1

Authorization Request

Redirect users to the authorization endpoint with client_id and scopes.

2

User Authorization

User logs in and approves the requested permissions.

3

Authorization Code

User is redirected back with an authorization code.

4

Token Exchange

Exchange the code for access and refresh tokens.

Available Scopes

ScopeAccess
stores:readRead store information and settings
customers:readRead customer profiles and analytics
orders:readRead order data and history
products:readRead product catalog and categories
segments:readRead customer segments and rules
segments:writeCreate and modify segments

Best Practices

Request Minimal Scopes

Only request the permissions your integration actually needs.

Store Secrets Securely

Never commit Client Secrets to version control. Use environment variables.

Use HTTPS

Always use HTTPS for redirect URIs in production.

Implement Token Refresh

Don't rely on long-lived tokens. Implement automatic token refresh.