PostikaDocs

Search

Search the docs…

Build

OAuth apps

Building a product on top of Postika? Register an OAuth app so any Postika user can authorize it to read their calendar and schedule posts for them.

Create an app

  1. 1
    In Postika, open any project and go to Connect AI (Conectar IA).
  2. 2
    Scroll to Developers · OAuth apps (Developers · Apps OAuth) and click Create OAuth app (Crear app OAuth).
  3. 3
    Enter the app name users will see and your redirect URLs, one per line.
  4. 4
    Copy the client ID and the client secret. The secret is shown only once.

Apps belong to your user, not to a project. You can create up to 20. Deleting an app revokes every token issued to it immediately.

Client ID and secret

CredentialPrefixWhere it goes
Client IDptc_Public. client_id on /oauth/authorize and /api/oauth/token.
Client secretptsec_Server only. client_secret in the token request body, or HTTP Basic.

Apps with a secret must send it on every token request, or Postika answers 401 invalid_client. PKCE is still required.

Never put the client secret in a browser, desktop or mobile build. Public clients should use dynamic registration instead, which issues no secret.

Scopes

There is a single scope, mcp, granted with every authorization. It lets your app act as the user on all of their projects:

  • List projects, channels and calendar posts.
  • Create posts in any mode (draft, approval, schedule, now).
  • Delete posts from Postika, unless they are being published right now. Published posts stay on the network.

The consent screen tells the user exactly this, and that posts can wait for their approval.

Redirect URIs

AllowedExample
HTTPShttps://app.example.com/oauth/callback
Loopback (any port)http://127.0.0.1/callback
Custom app schememyapp://oauth

The redirect_uri in the request must match one you registered exactly. Loopback URIs match on host and path with any port, for desktop tools that pick a random port. Plain http to other hosts, fragments, and schemes such as javascript: or data: are rejected.

End-to-end flow

  1. 1
    Generate a PKCE verifier and challenge, then redirect the user to:
    https://postika.app/oauth/authorize
  ?response_type=code
  &client_id=ptc_…
  &redirect_uri=https://app.example.com/oauth/callback
  &code_challenge=…
  &code_challenge_method=S256
  &state=…
  2. 2
    The user signs in to Postika and clicks Allow (Permitir). You receive ?code=ptcode_…&state=… on your redirect URI.
  3. 3
    Exchange the code on your server:
    curl https://postika.app/api/oauth/token \
  -u "ptc_…:ptsec_…" \
  -d grant_type=authorization_code \
  -d code=ptcode_… \
  -d redirect_uri=https://app.example.com/oauth/callback \
  -d code_verifier=…
  4. 4
    Call the REST API or the MCP server with Authorization: Bearer ptat_…, passing project_id when the user has several projects.
  5. 5
    Refresh before the hour is up with grant_type=refresh_token and store the new refresh token. Details in Refresh and rotation.

Users see your app under Connect AI → Connected AIs (Conectar IA → IAs conectadas) and can disconnect it at any time. Calls also need the user's subscription to be active, or the API answers 402.