Connect other users with OAuth

OAuth lets a user authorize your integration without sharing their API key. Your integration receives an access token and uses it to call the same REST API.

OAuth endpoints issue tokens. REST endpoints perform actions. They serve different purposes:

Purpose	URL
Ask a user to authorize your integration	https://api.socialchamp.com/oauth2/authorize
Exchange an authorization code or refresh a token	https://api.socialchamp.com/oauth2/token
Make REST requests	https://api.socialchamp.com/v1/rest

Before you start

You need a registered OAuth client, its client ID and secret, and an approved redirect URI. Use the credentials assigned to your integration. If you do not have a registered client, contact Social Champ support; this guide does not provide a self-service REST client registration endpoint.

1. Ask the user to authorize access

Open the authorization URL in the user's browser with these query parameters:

Parameter	Value
response_type	code
client_id	Your integration's client ID.
redirect_uri	Your registered callback URL.
scope	Requested scopes, separated by spaces. See permissions.
state	A random value your integration stores and checks on the callback.

The user signs in and authorizes access. Your callback receives an authorization code. Verify state before exchanging the code.

2. Exchange the code

Set the variables below to your integration's values. Run the exchange on your server, where the client secret can stay private.

curl -X POST 'https://api.socialchamp.com/oauth2/token' \
  -u "$SOCIALCHAMP_CLIENT_ID:$SOCIALCHAMP_CLIENT_SECRET" \
  --data-urlencode 'grant_type=authorization_code' \
  --data-urlencode "code=$SOCIALCHAMP_AUTH_CODE" \
  --data-urlencode "redirect_uri=$SOCIALCHAMP_REDIRECT_URI"

Save the returned access_token and refresh_token securely. The current REST OAuth flow returns access_token_expiry and refresh_token_expiry as expiry dates. It does not return the same token envelope as the MCP flow: do not require token_type, expires_in, or scope in this response. Send the access token as a bearer token regardless.

Example fields (token values are placeholders):

{
  "access_token": "ACCESS_TOKEN",
  "access_token_expiry": "2030-03-16T10:00:00.000Z",
  "refresh_token": "REFRESH_TOKEN",
  "refresh_token_expiry": "2031-01-15T10:00:00.000Z"
}

3. Make REST requests

curl 'https://api.socialchamp.com/v1/rest/channels' \
  -H "Authorization: Bearer $SOCIALCHAMP_ACCESS_TOKEN"

4. Refresh access

curl -X POST 'https://api.socialchamp.com/oauth2/token' \
  -u "$SOCIALCHAMP_CLIENT_ID:$SOCIALCHAMP_CLIENT_SECRET" \
  --data-urlencode 'grant_type=refresh_token' \
  --data-urlencode "refresh_token=$SOCIALCHAMP_REFRESH_TOKEN"

Store the new tokens returned by the exchange. If refresh fails because access has expired or been revoked, ask the user to reconnect.

Connecting an AI assistant

MCP clients use a separate connection flow under /oauth2/mcp/*. Follow Connect an AI assistant for that setup.