OAuth apps

If you’re building a product that schedules posts on behalf of other Beeive users, don’t ask them for their API keys. Register an OAuth app instead. Each user approves your app once, and you get a token that works with the API, the MCP server and the CLI, just like an API key.

To automate only your own account, you don’t need this: use your API key.

1. Create your app

1. In Beeive, go to Settings → Developers, then the Apps tab.

2. Click Create OAuth App and fill in:

   • App Name and Description: shown to users when they approve your app.
   • Profile Picture: your app’s logo.
   • Redirect URL: where Beeive sends users after they approve, for example https://yourapp.com/beeive/callback.

3. Click Create. Under Credentials, copy your Client ID and Client Secret.

Caution

Keep the Client Secret on your server and never ship it in a browser or mobile app. If it leaks, click Rotate Secret.

2. Send the user to Beeive

Redirect the user to:

https://beeive.com/oauth/authorize
  ?client_id=YOUR_CLIENT_ID
  &response_type=code
  &redirect_uri=https://yourapp.com/beeive/callback
  &state=RANDOM_STRING

state is a random value you generate and store. Check it when the user comes back to protect against forged requests.

The user signs in to Beeive if needed and sees your app’s name and logo with Approve and Deny.

3. Handle the redirect

Beeive sends the user back to your Redirect URL:

• Approved: https://yourapp.com/beeive/callback?code=AUTH_CODE&state=RANDOM_STRING
• Denied: https://yourapp.com/beeive/callback?error=access_denied&state=RANDOM_STRING

Check that state matches the value you stored.

4. Exchange the code for a token

From your server:

curl https://app.beeive.com/oauth/token \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "AUTH_CODE",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "redirect_uri": "https://yourapp.com/beeive/callback"
  }'

Response:

{
  "access_token": "pos_...",
  "token_type": "bearer"
}

Store the token securely. It’s tied to the user’s Beeive account.

5. Use the token

The pos_ token works everywhere an API key does:

Where	How
Public API	Authorization: pos_... (no Bearer prefix)
MCP server	Authorization: Bearer pos_...
CLI	BEEIVE_API_KEY=pos_...

curl https://app.beeive.com/public/v1/integrations \
  -H "Authorization: pos_YOUR_TOKEN"

Revoking access

Users can revoke your app at any time under Settings → Approved Apps in Beeive. After that, the token returns 401 Invalid OAuth token, so your app should handle this by asking the user to connect again.