OAuth Apps

POST /v1/access/oauth-apps
{
  "name": "MyIntegration",
  "homepage_url": "https://myapp.example.com",
  "redirect_uris": ["https://myapp.example.com/oauth/callback"],
  "scopes": ["office:read", "project:read", "project:write"]
}

1. Generate code_verifier and code_challenge
2. Redirect user to:
   https://access.essal.cloud/oauth/authorize
     ?client_id=YOUR_CLIENT_ID
     &redirect_uri=https://myapp.example.com/oauth/callback
     &response_type=code
     &scope=office:read project:write
     &code_challenge=BASE64URL(SHA256(verifier))
     &code_challenge_method=S256

3. User approves → redirect to your callback with ?code=AUTH_CODE

4. Exchange for tokens:
   POST https://access.essal.cloud/oauth/token
   {
     "grant_type": "authorization_code",
     "code": "AUTH_CODE",
     "redirect_uri": "https://myapp.example.com/oauth/callback",
     "client_id": "YOUR_CLIENT_ID",
     "code_verifier": "VERIFIER"
   }

POST https://access.essal.cloud/oauth/token
{
  "grant_type": "refresh_token",
  "refresh_token": "YOUR_REFRESH_TOKEN",
  "client_id": "YOUR_CLIENT_ID"
}