Skip to main content
OAuth 2.0 is the recommended authentication method for multi-tenant integrations. Lofty supports two grant types:

​
Prerequisites

You need a Developer Platform account and a registered application. Sign up at the Lofty Developer Portal.

​
Authorization Code flow

1

Register your application

Create a new application in the Developer Portal. Provide your app name, description, and redirect URI(s).New applications start in Development Mode — you can test the full OAuth flow without review.
2

Obtain credentials

After registration, you’ll receive a Client ID and Client Secret.
Never expose your Client Secret in client-side code, public repositories, or logs.
3

Request an access token

Exchange your credentials for an access token via the OAuth 2.0 authorization code flow.
The Authorization header uses HTTP Basic authentication: Base64-encode <CLIENT_ID>:<CLIENT_SECRET> to produce the credential string.For complete token endpoint details, see the OAuth 2.0 API Reference.
4

Authenticate requests

Pass the access token in the Authorization header:

​
PKCE flow

For SPAs and native apps that cannot securely store a client secret. Uses a code verifier/challenge instead.
No client_secret is required. The Lofty CLI uses this flow for interactive browser login (lofty-cli auth login-browser).

​
Permission scopes

Each token is scoped to the endpoints granted to your application in the Developer Portal. Calling an out-of-scope endpoint returns HTTP 403:
Adding scopes is a breaking change. When you add new permission scopes to a production app, all existing tokens are invalidated (authorized_api_ids changes). Existing users must re-authorize your app. Always notify users before adding scopes.

​
Rate limits by app mode

Rate limits are per-app, not per-account. Set on app_info.rate_limit_per_minute.

​
App lifecycle

​
Updating a production app

Once in production, edits require review before taking effect. Your app continues operating with the current approved configuration during review. Non-breaking changes — app name, description, redirect URIs, removing scopes. Existing connections are unaffected. Breaking changes — adding new permission scopes invalidates existing tokens. Users must re-authorize. Notify users before submitting.
No. Edit controls are locked during review. Cancel the pending edit first if you need to make urgent changes.
Your app continues operating with its current configuration. You’ll receive the decline reason via email and can resubmit after making adjustments.