OAuth apps

How approved apps like Zapier connect to Finerlise workspaces with OAuth 2.0.

Finerlise runs an OAuth 2.0 authorization server so approved apps can act on a user’s behalf without handling passwords or API keys. Today it’s used by the Zapier integration.

Endpoints

	URL
Authorization	`https://finerlise.com/oauth/authorize`
Token	`https://finerlise.com/api/oauth/token`
Revocation	`https://finerlise.com/api/oauth/revoke`
Server metadata	`https://finerlise.com/.well-known/oauth-authorization-server`

Flow

Send the user to /oauth/authorize with response_type=code, your client_id, redirect_uri, scope and state.
The user signs in, picks a workspace and approves access.
Exchange the returned code (valid for 5 minutes) at the token endpoint with grant_type=authorization_code. Authenticate with client_secret_basic or client_secret_post.
Call the API with the access token (fnr_oat_…, valid for 1 hour).
Get a new access token with grant_type=refresh_token and the refresh token (fnr_ort_…).

Scopes

Scope	Allows
`responses:read`	Read completed responses.
`forms:read`	List the workspace’s forms.
`hooks:write`	Subscribe to and unsubscribe from new responses.

If no scope is requested, all three are granted. Workspace admins can disconnect an app at any time under Settings → API keys → Connected apps.