OAuth apps

We support OAuth 2.0 with PKCE. Third-party applications register an OAuth app, redirect users through a consent screen, exchange the resulting authorization code for tokens, and call the API on behalf of those users. All token traffic uses bearer tokens in the standard Authorization header.

These endpoints cover three areas: managing OAuth applications (registration, update, deletion), the authorization flow (consent screen, code exchange, token refresh, revocation), and reviewing or revoking grants that users have already approved.

---

Applications

List OAuth applications

GET/v1/oauth/applicationsList OAuth applications

Lists all registered OAuth applications. Supports pagination and quick search by name or ID, plus filtering by owner user ID.

Administrator only.

curl https://api.galaxygate.net/v1/oauth/applications \
  -A 'curl/8.5' \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN"

Returns a paged list of OAuth application objects.

---

Register an OAuth application

POST/v1/oauth/applicationsRegister a new OAuth application

Creates a new OAuth application. The client_secret is returned only in this response; it cannot be retrieved again. Save it securely. Rotate it with POST /v1/oauth/applications/{id}/secret if it is ever exposed.

Administrator only.

Request body

Field	Type	Required	Description
name	string	yes	Application name (4-128 characters)
description	string		Application description (up to 1024 characters)
redirect_uris	string[]	yes	Allowed redirect URIs. HTTPS required; HTTP is permitted for localhost only.
scopes	string[]	yes	OAuth scopes this application may request

Returns the created application object, including client_id and the one-time client_secret.

---

Fetch an OAuth application

GET/v1/oauth/applications/{id}Get an OAuth application

Returns the full detail for a single OAuth application.

Administrator only.

Path parameters

Name	Type	Description
id	integer	Application ID

Returns the application object. The client_secret is never returned on reads.

---

Update an OAuth application

PATCH/v1/oauth/applications/{id}Update an OAuth application

Updates the application. All fields are optional; send only what you are changing. Only the application owner may update it.

Administrator only.

Path parameters

Name	Type	Description
id	integer	Application ID

Request body

Field	Type	Description
name	string	Application name (4-128 characters)
description	string	Application description (up to 1024 characters)
redirect_uris	string[]	Updated list of allowed redirect URIs
scopes	string[]	Updated set of allowed scopes
active	boolean	Set to false to suspend the application without deleting it

Returns the updated application object.

---

Delete an OAuth application

DELETE/v1/oauth/applications/{id}Delete an OAuth application

Deletes the application and cascades to all authorization records, codes, and tokens issued to it. This cannot be undone. Only the application owner may delete it.

Administrator only.

Path parameters

Name	Type	Description
id	integer	Application ID

Returns 202 Accepted with an empty body.

---

Regenerate a client secret

POST/v1/oauth/applications/{id}/secretRegenerate the client secret

Rotates the client secret. The new plaintext secret is returned only in this response; the old secret is invalidated immediately.

Path parameters

Name	Type	Description
id	integer	Application ID

Returns

Field	Type	Description
client_secret	string	New client secret; only returned once

---

List your own OAuth applications

GET/v1/users/@me/oauth-appsList OAuth applications you own

Lists the OAuth applications owned by the authenticated user. Supports pagination and quick search by name or ID.

Returns a paged list of application objects.

---

Authorization flow

The standard PKCE flow is:

1. Your app generates a code_verifier and computes code_challenge = base64url(SHA-256(code_verifier)).
2. Redirect the user to the panel's /oauth/authorize page with the parameters described below. The panel calls GET /v1/oauth/authorize to populate its consent screen.
3. The user approves or denies. The panel calls POST /v1/oauth/authorize and then redirects the user back to your redirect_uri with a code query parameter.
4. Your server exchanges the code for tokens via POST /v1/oauth/token.
5. Use the access_token as a bearer token. When it expires, use the refresh_token to obtain a new pair.

---

Get consent screen info

GET/v1/oauth/authorizeFetch consent screen details

Returns the application details and requested scopes that the panel uses to render the consent screen. The user must be logged in.

Query parameters

Name	Type	Required	Description
client_id	string	yes	Application client identifier
redirect_uri	string	yes	Must match a registered redirect URI
scope	string	yes	Space-delimited list of requested scopes
response_type	string	yes	Must be code
code_challenge	string	yes	base64url(SHA-256(code_verifier))
code_challenge_method	string	yes	Must be S256

Returns

Field	Type	Description
application	object	Application summary: id, name, description
requested_scopes	string[]	Scopes the application is asking for
previously_approved_scopes	string[]	Scopes this user already approved for this app (empty on first authorization)

---

Approve or deny an authorization request

POST/v1/oauth/authorizeSubmit the consent decision

Called after the user makes a consent decision on the panel's consent screen. The user must be logged in.

Request body

Field	Type	Required	Description
client_id	string	yes	Application client identifier
redirect_uri	string	yes	Must match a registered redirect URI
response_type	string	yes	Must be code
scope	string[]	yes	Scopes the user is approving
state	string	yes	Opaque value from the original authorization request; echoed back in the redirect
code_challenge	string	yes	base64url(SHA-256(code_verifier))
code_challenge_method	string	yes	Must be S256
approve	boolean	yes	true to approve; false to deny

Returns

Field	Type	Description
redirect_uri	string	The redirect URI with code and state appended (on approval), or error and error_description (on denial)

---

Exchange a code or refresh a token

POST/v1/oauth/tokenExchange code or refresh token for access tokens

OAuth 2.0 token endpoint. The request body must be application/x-www-form-urlencoded. No bearer token is required; the client authenticates via client_id and client_secret in the form body.

No authentication required.

Form body - authorization_code grant

Field	Type	Required	Description
grant_type	string	yes	authorization_code
client_id	string	yes	Application client identifier
client_secret	string	yes	Application client secret
code	string	yes	Authorization code from the redirect
redirect_uri	string	yes	Must match the URI used in the authorization request
code_verifier	string	yes	PKCE verifier that was hashed to produce code_challenge

Form body - refresh_token grant

Field	Type	Required	Description
grant_type	string	yes	refresh_token
client_id	string	yes	Application client identifier
client_secret	string	yes	Application client secret
refresh_token	string	yes	Refresh token from a previous grant or refresh

# Exchange authorization_code
curl -X POST https://api.galaxygate.net/v1/oauth/token \
  -A 'curl/8.5' \
  --data-urlencode grant_type=authorization_code \
  --data-urlencode client_id=gg_client_... \
  --data-urlencode client_secret=gg_secret_... \
  --data-urlencode code=<code> \
  --data-urlencode redirect_uri=https://yourapp.example.com/callback \
  --data-urlencode code_verifier=<verifier>

Returns

Field	Type	Description
access_token	string	Bearer token to use in API calls
token_type	string	Always Bearer
expires_in	integer	Lifetime of the access token in seconds
refresh_token	string	Token to use when refreshing; present on both initial grant and refresh
scope	string	Granted scopes, space-delimited

On error the response is 400 Bad Request with a JSON body containing error and error_description.

---

Revoke a token

POST/v1/oauth/revokeRevoke an access or refresh token

RFC 7009 token revocation. The request body must be application/x-www-form-urlencoded. Always returns 200 OK regardless of whether the token was found, to avoid revealing token validity.

No authentication required.

Form body

Field	Type	Required	Description
token	string	yes	Access or refresh token to revoke
client_id	string	yes	Application client identifier
client_secret	string	yes	Application client secret

Returns 200 OK with an empty body.

---

Authorizations

An authorization record is created the first time a user approves a consent screen for an application. Revoking it invalidates all access and refresh tokens issued to that application for that user.

List your authorized apps

GET/v1/oauth/authorizationsList apps you have authorized

Lists all OAuth applications the authenticated user has approved. Supports pagination and quick search by application name, plus filtering by application ID. Each entry shows the application, the approved scopes, and when the authorization was granted.

Returns a paged list of authorization objects.

---

Revoke an authorization

DELETE/v1/oauth/authorizations/{id}Revoke an app authorization

Revokes an authorization and deletes all access and refresh tokens the application holds for this user. The application will need to go through the consent screen again to regain access.

Path parameters

Name	Type	Description
id	integer	Authorization ID

Returns 202 Accepted with an empty body.

---

List all authorizations (admin)

GET/v1/oauth/admin/authorizationsList all authorizations across all users

Lists every OAuth authorization across all users. Supports pagination and filtering by user ID, application ID, application name, and scope.

Administrator only.

Returns a paged list of full authorization objects, each including the owning user.