OAuth apps

OAuth apps are for software other labels connect, without handing you a key: a distribution tool, a royalty system, an analytics dashboard. The label approves your app on a consent screen; your app gets tokens that act for the member who approved it, within the scopes they allowed and their role.

Make an app#

Make the app in Workspace › API under Apps: a name, your redirect addresses (https, or http on localhost while you build) and the scopes it asks for. You get a client id (smc_…) and a secret (smcs_…, shown once). A new app is private to your organization until Stillmore Group opens it to everyone.

The authorization code flow#

The flow is authorization code with PKCE (S256 only) and your client secret.

1. Make a random code_verifier and its code_challenge: base64url(SHA-256(verifier)).
2. Send the member to the consent screen:

https://app.stillmoregroup.com/oauth/authorize?response_type=code&client_id=smc_…
  &redirect_uri=https://your.app/callback&scope=releases:read%20finance:read
  &state=…&code_challenge=<base64url(sha256(verifier))>&code_challenge_method=S256

1. They come back to your redirect_uri with code and state. Check state, then swap the code for tokens:

curl https://api.stillmoregroup.com/api/oauth/token \
  -u "smc_…:smcs_…" \
  -d grant_type=authorization_code -d code=… \
  -d redirect_uri=https://your.app/callback -d code_verifier=…

The answer holds access_token (sm_oat_…, an hour), refresh_token (sm_ort_…, 60 days) and the scope granted. Call the API with the access token exactly like a key.

Refreshing and revoking#

Swap the refresh token for a new pair with grant_type=refresh_token. A refresh token works once: using one again ends the connection, so a stolen token can't be used quietly. POST https://api.stillmoregroup.com/api/oauth/revoke withdraws a token; the label can also disconnect your app in their API tab at any time.