OAuth apps

Building something other 360Nook customers install? Register it under Settings → Developer apps, then run the authorization code flow with PKCE.

• Send the customer to /oauth/authorize with your client_id, an exact registered redirect_uri, scope, state and an S256 code_challenge.
• They approve, and we redirect back with a code and your state, untouched.
• Exchange it at POST /api/oauth/token for an access and refresh token.

curl -X POST https://app.360nook.com/api/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "client_id": "nook_app_...",
    "client_secret": "nook_cs_...",
    "code": "<from the redirect>",
    "redirect_uri": "https://your-app.com/oauth/callback",
    "code_verifier": "<the PKCE verifier>"
  }'

Refresh tokens rotate. If a rotated refresh token is presented again we revoke the whole grant, because we cannot tell a replay from a leak — store the newest one you were given and discard the old.

Redirect URIs are matched exactly — never by prefix, never with a wildcard. Prefix matching is how an authorization code ends up delivered to an attacker’s path on an otherwise legitimate host.