OAuth 2.0 guide

Authorization code flow, PKCE, exchanging and refreshing tokens.

Step 1 — Start the flow

On your server, POST to /v1/login with your redirect URI and requested scopes. You get back an authorize_url.

Request

curl -X POST https://cloud.uflow.uz/v1/login \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer uf_live_xxxx" \
  -d '{
    "redirect_uri": "https://myapp.com/callback",
    "scopes": ["user:read"]
  }'

Response

{
  "data": {
    "authorize_url": "https://id.uflow.uz/oauth/authorize?client_id=…",
    "expires_in": 600,
    "token_endpoint": "https://cloud.uflow.uz/oauth/token"
  }
}

Step 2 — User consents

Redirect the user to authorize_url. They log in (if needed), see the consent screen, and are sent back to your redirect_uri with a ?code=… query parameter.

Step 3 — Exchange the code

POST the code to /oauth/token to receive an access token.

Token exchange

curl -X POST https://cloud.uflow.uz/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "abc123",
    "client_id": "app_xxx",
    "redirect_uri": "https://myapp.com/callback"
  }'

Response

{
  "access_token": "uf_at_…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "uf_rt_…",
  "scope": "user:read"
}

PKCE (SPA va mobil uchun)

Clients that cannot keep a secret must send a code_challenge (SHA-256 of a random verifier) on /v1/login and the original code_verifier on /oauth/token.

Treat refresh tokens like passwords — never store them in the browser. Use httpOnly cookies.