Authentication

Resolved uses OAuth 2.0 for authentication. Your app never handles a customer's password: the customer signs in on Resolved, approves the scopes your app requests, and Resolved hands your app an access token.

The authorization code flow#

1. Redirect the customer to the Resolved authorization endpoint with your client_id, redirect_uri and the scopes you need.
2. The customer signs in and approves. Resolved redirects back to your redirect_uri with a short-lived code.
3. Your app exchanges that code for an access token and a refresh token.

POST /oauth/v2/token HTTP/1.1
Host: login.resolved.nl
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=THE_CODE
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET
&redirect_uri=https://your-app.example.com/callback

A successful exchange returns a bearer token:

{
  "token_type": "Bearer",
  "expires_in": 3600,
  "access_token": "eyJ0eXAiOiJKV1Qi...",
  "refresh_token": "def50200a1b2c3..."
}

Refreshing tokens#

Access tokens are short-lived. Use the refresh token to obtain a new access token without involving the customer again.

Scopes#

Request only the scopes your app genuinely needs. A customer sees the full list at install time, and narrower requests are approved more readily. See Making requests for how scopes gate each endpoint.