Error

A valid request URL is required to generate request examples

{
  "success": true,
  "data": {
    "redirectTo": "https://zapier.com/dashboard/auth/oauth/return/FlowyteCLIAPI/?code=oac_9f2a01&state=xyz789csrf"
  }
}

{
  "type": "about:blank",
  "title": "<string>",
  "status": 123,
  "detail": "<string>",
  "instance": "<string>",
  "code": "<string>",
  "errors": [
    {
      "field": "<string>",
      "message": "<string>"
    }
  ]
}

{
  "type": "about:blank",
  "title": "<string>",
  "status": 123,
  "detail": "<string>",
  "instance": "<string>",
  "code": "<string>",
  "errors": [
    {
      "field": "<string>",
      "message": "<string>"
    }
  ]
}

{
  "type": "about:blank",
  "title": "<string>",
  "status": 123,
  "detail": "<string>",
  "instance": "<string>",
  "code": "<string>",
  "errors": [
    {
      "field": "<string>",
      "message": "<string>"
    }
  ]
}

{
  "type": "about:blank",
  "title": "<string>",
  "status": 123,
  "detail": "<string>",
  "instance": "<string>",
  "code": "<string>",
  "errors": [
    {
      "field": "<string>",
      "message": "<string>"
    }
  ]
}

OAuth2

Approve or deny an OAuth2 authorization (mints the code)

Called by the web consent screen AFTER a signed-in user approves (or denies). It re-validates the client_id, exact redirect_uri, requested scope (subset of the client’s max ∩ ValidScopes), state and optional PKCE server-side — the query params carried through the browser are untrusted — and confirms the user is acting as the org being authorized (orgId == the token’s active org). On approve it mints a single-use, 10-minute authorization code and returns the redirectTo URL (redirect_uri?code=…&state=…); on deny it returns redirect_uri?error=access_denied. HUMAN-ONLY: a service principal (API key or OAuth token) is rejected with 403 even if scoped.

POST

/

oauth

/

consent

Error

A valid request URL is required to generate request examples

{
  "success": true,
  "data": {
    "redirectTo": "https://zapier.com/dashboard/auth/oauth/return/FlowyteCLIAPI/?code=oac_9f2a01&state=xyz789csrf"
  }
}

{
  "type": "about:blank",
  "title": "<string>",
  "status": 123,
  "detail": "<string>",
  "instance": "<string>",
  "code": "<string>",
  "errors": [
    {
      "field": "<string>",
      "message": "<string>"
    }
  ]
}

{
  "type": "about:blank",
  "title": "<string>",
  "status": 123,
  "detail": "<string>",
  "instance": "<string>",
  "code": "<string>",
  "errors": [
    {
      "field": "<string>",
      "message": "<string>"
    }
  ]
}

{
  "type": "about:blank",
  "title": "<string>",
  "status": 123,
  "detail": "<string>",
  "instance": "<string>",
  "code": "<string>",
  "errors": [
    {
      "field": "<string>",
      "message": "<string>"
    }
  ]
}

{
  "type": "about:blank",
  "title": "<string>",
  "status": 123,
  "detail": "<string>",
  "instance": "<string>",
  "code": "<string>",
  "errors": [
    {
      "field": "<string>",
      "message": "<string>"
    }
  ]
}

Authorizations

Authorization

string

header

required

Flowyte secret API key (Authorization: Bearer flowyte_sk_live_…). Scope-gated; is scoped to your organization — a key can never reach another tenant. The listed scopes in each operation's apiKey requirement are the scopes that key must hold. The tokenUrl is nominal: keys are minted in the dashboard.

Body

application/json

clientId

string

required

The registered OAuth client id.

redirectUri

string

required

Must EXACTLY match a registered redirect URI.

state

string

required

Opaque CSRF value echoed back to the client.

orgId

string

required

The org to authorize; must equal the caller's active org.

approve

boolean

required

true to grant

scope

string

Space-separated requested scopes (subset of the client max).

codeChallenge

string

Optional PKCE challenge (S256).

codeChallengeMethod

enum<string>

PKCE method; S256 only.

Available options:

S256

Response

The browser should be sent to redirectTo.

data

object

Show child attributes

success

boolean