Authentication

Third-party apps authenticate a Sparro customer with the OAuth2 authorization-code flow. PKCE (code_challenge, code_challenge_method=S256) is required for public clients.

1. Redirect to authorize

Send the org owner's browser to /oauth/authorize with your client ID, redirect URI, and the scopes you're requesting (see Scopes). You can start from the Sparro-hosted Connect URL instead, which lets the person pick a company first; see Connect. Only an owner of the company can approve.

curl -X GET "https://app.sparro.dk/api/v2/oauth/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=https%3A%2F%2Fexample.com%2Fcallback&scope=invoices%3Aread%20customers%3Aread&code_challenge_method=S256"

2. Exchange the code for a token

After the owner approves, they land back on your redirect URI with a code. Exchange it at /oauth/token:

curl -X POST "https://app.sparro.dk/api/v2/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&code=$CODE&redirect_uri=$REDIRECT_URI"

3. Call the API

Send the resulting access token as a bearer credential on every request. A missing or invalid token returns 401. See Rate limits for how long the token lasts.