Build an app

OAuth

Confidential clients use the authorization code grant. Users approve scopes in the Invoist app; you exchange the code for access and refresh tokens.

Authorize

Send the user (browser) to the consent page in the Invoist app. They must be signed in as a workspace admin.

Authorize URL

Terminal

https://app.invoi.st/oauth/authorize?client_id=inv_app_…&redirect_uri=https://yourapp.com/callback&response_type=code&scope=documents:read%20documents:write&state=…

On approve, we redirect to your redirect_uri with code and state. On deny, error=access_denied.

Token

Authenticate with HTTP Basic (client_id:client_secret) or body fields. Access tokens are prefixed inv_at_ and last one hour; refresh tokens are inv_rt_.

Exchange code

Terminal

12345curl -X POST https://api.invoi.st/oauth/token \
  -u 'inv_app_…:inv_cs_…' \
  -d 'grant_type=authorization_code' \
  -d 'code=inv_ac_…' \
  -d 'redirect_uri=https://yourapp.com/callback'

Refresh

Terminal

1234curl -X POST https://api.invoi.st/oauth/token \
  -u 'inv_app_…:inv_cs_…' \
  -d 'grant_type=refresh_token' \
  -d 'refresh_token=inv_rt_…'

Call the API

Bearer access token

Terminal

curl https://api.invoi.st/v1/documents \
  -H "Authorization: Bearer inv_at_…"

Redirect URIs

Only exact URIs registered on the app are accepted. Use HTTPS in production.

Revoke

Terminal

curl -X POST https://api.invoi.st/oauth/revoke \
  -d 'token=inv_at_…'

Users can also Disconnect from Integrations, which revokes the install and all tokens immediately.