Build integrations that connect to other people's Brivio organizations with their consent — the standard authorization-code flow with PKCE.
In Developers → Apps, register an OAuth app to get a client_id (and a client_secret for confidential clients). Configure your redirect URIs and the scopes you need.
https://app.brivio.ro/api/oauth/authorize ?client_id=YOUR_CLIENT_ID &redirect_uri=https://yourapp.com/callback &response_type=code &scope=invoices:read invoices:write contacts:read &state=RANDOM_STATE &code_challenge=BASE64URL(SHA256(verifier)) &code_challenge_method=S256
The user signs in, picks the organization and environment (live or sandbox) to grant, and reviews your requested scopes on the consent screen.
POST https://app.brivio.ro/api/oauth/token Content-Type: application/x-www-form-urlencoded grant_type=authorization_code &code=AUTH_CODE &redirect_uri=https://yourapp.com/callback &client_id=YOUR_CLIENT_ID &code_verifier=VERIFIER
{
"access_token": "brivio_at_...",
"refresh_token": "brivio_rt_...",
"token_type": "Bearer",
"expires_in": 3600,
"scope": "invoices:read invoices:write contacts:read"
}Access tokens work exactly like API keys against https://api.brivio.ro/v1. Refresh tokens rotate on every use — reusing an old refresh token revokes the whole chain (leak protection), so always persist the newest pair.
authorization_code (+PKCE) for user-delegated access, refresh_token for rotation, and client_credentials for app-level access to organizations that installed your app.