Shopify
Use dedicated Shopify routes in this app for token exchange and verification.
OAuth control room
OAuth is never just one click
Every provider bends the rules a little differently: naming changes, payload quirks, refresh caveats, verification edge cases. This hub gives you one place to run every workflow, with the guidance attached to the provider it belongs to.
Most used providers
Start from the provider you actually need.
Built-in workflow
Exchange a short-lived token for a 60-day long-lived token, verify it, and refresh it before expiry.
HubSpot
Uses HubSpot OAuth v3 token endpoints; token metadata verification embeds the access token in the URL path.
QuickBooks
realmId is required for many QuickBooks API calls after token exchange.
Slack
Slack bot tokens are commonly long-lived and refresh token support varies by app setup.
Commerce7
Shopify
Use dedicated Shopify routes in this app for token exchange and verification.
Stripe Connect
Stripe Connect token exchange authenticates with your Stripe secret key and does not send client_id in the token request.
PayPal
Use sandbox endpoints in development by replacing host with api-m.sandbox.paypal.com.
Amazon SP-API
Requires Amazon's SP-API install callback fields and LWA token handling; not supported by the generic OAuth form.
eBay
Token verification can fail unless user-related scopes are granted.
Etsy
Etsy requires S256 PKCE and an API key header on Open API v3 resource requests.
BigCommerce
BigCommerce app installation posts a code, scope, and store context to the app callback; it is not a normal user-entered authorization-code form.
Productivity / Enterprise18
Use access_type=offline and prompt=consent for reliable refresh token issuance.
Microsoft Graph
Tenant-specific endpoints may be required for enterprise scenarios.
Slack
Slack bot tokens are commonly long-lived and refresh token support varies by app setup.
GitHub
GitHub OAuth apps typically issue non-refreshable tokens unless using expiring user tokens with specific settings.
Atlassian
Uses rotating refresh tokens with strict reuse rules.
GitLab
This workflow targets GitLab.com. Self-managed GitLab instances require instance-specific endpoints.
Bitbucket Cloud
OAuth consumer permissions are configured at the Bitbucket workspace rather than selected per authorization request.
Notion
Public connections authorize a workspace and selected pages; the token response includes workspace and bot metadata.
Asana
Requested scopes must first be enabled for the app in Asana's developer console.
Linear
User authorization returns 24-hour access tokens and rotating refresh tokens; PKCE is also supported.
Airtable
Airtable requires S256 PKCE, at least one registered scope, and explicit base or workspace resource selection.
Zoom
This workflow covers confidential user authorization. Zoom Server-to-Server and public PKCE apps use different grant requirements.
DocuSign
These endpoints target DocuSign production. Demo accounts use account-d.docusign.com until the integration passes go-live review.
monday.com
This workflow uses monday.com's new OAuth 2.1 endpoint with mandatory S256 PKCE and rotating refresh tokens.
WordPress.com / Jetpack
WordPress.com authorization may target one blog or broader scopes, and token inspection requires both client ID and token query parameters.
Auth0
Auth0 endpoints, audiences, connections, and token claims are tenant-specific; the workflow must start from the tenant issuer URL.
Okta
Okta uses tenant-specific issuers and may use the org authorization server or a named custom authorization server.
Adobe
Adobe IMS user authentication is product- and project-specific; APIs define their own scopes, approval rules, and production promotion requirements.
CRM / Finance11
HubSpot
Uses HubSpot OAuth v3 token endpoints; token metadata verification embeds the access token in the URL path.
Salesforce
Use test.salesforce.com for sandbox orgs.
QuickBooks
realmId is required for many QuickBooks API calls after token exchange.
Box
Refresh tokens rotate frequently; store latest refresh token after each refresh.
Dropbox
Use token_access_type=offline to request refresh tokens.
Xero
After authorization, retrieve the Xero tenant list and retain the selected tenant ID with the token record.
FreshBooks
FreshBooks returns account and business identifiers that are required by later accounting API calls.
Mailchimp
Use the OAuth metadata response to discover the account-specific API endpoint and data-center prefix.
Klaviyo
Klaviyo requires mandatory PKCE, Basic client authentication, account-scoped tokens, API revision headers, and marketplace review rules.
Zendesk
Zendesk OAuth endpoints are built from the customer's Zendesk subdomain, so a fixed generic provider endpoint is insufficient.
Freshdesk
Freshworks OAuth varies by product, account domain, and regional authorization host and needs a dedicated endpoint resolver.
Social / Content15
Meta (Facebook/Instagram)
Instagram long-lived token flow has provider-specific endpoints; use dedicated Instagram routes in this app.
Exchange a short-lived token for a 60-day long-lived token, verify it, and refresh it before expiry.
Some LinkedIn APIs require product approvals beyond standard OAuth scopes.
TikTok
TikTok often requires region and product-specific app enablement before scopes are usable.
X (Twitter)
PKCE is required for public clients in OAuth 2.0 flow.
Discord
Guild-level permissions may require additional bot flow setup beyond OAuth user auth.
Canva
Canva requires Authorization Code with S256 PKCE and explicit scopes enabled in the Developer Portal.
Spotify
Authorization Code is for confidential apps; desktop, mobile, and browser clients should use Spotify's PKCE flow.
Vimeo
Vimeo authorization-code tokens can remain active while used; this flow does not issue a standard refresh token.
Twitch
This workflow generates a user access token; app tokens use the separate Client Credentials grant.
YouTube Data API
Enable YouTube Data API v3 in the Google Cloud project and request only the YouTube scopes the workflow needs.
Figma
Figma authorization codes expire after 30 seconds; exchange immediately after the callback.
Patreon
Use a Patreon API v2 client and v2 identity/member scopes; public API v1 retires on 7 October 2026.
duration=permanent requests a refresh token; API requests with OAuth tokens use oauth.reddit.com.
Pinterest production access and available scopes depend on app review and product approval, so the workflow needs approval-aware guidance.
No providers match that search.
Provider names and logos are trademarks of their respective owners and are used only to identify each integration. OAuth Hub is not affiliated with or endorsed by any provider. Logo artwork from Simple Icons.