Getting startedAuthenticationOAuth authentication

OAuth 2.0

Integrate OAuth 2.0 authentication for private organizational integrations

OAuth 2.0 provides token-based authentication for private integrations that require user consent and delegated access. Use OAuth for internal applications within an organization that need user-specific permissions.

OAuth is currently only available for private integrations inside an organization. That is: non-public distributable apps. OAuth integrations are not yet intended for public distribution or listing in marketplaces.

For implementation details, see the step-by-step guide on bringing OAuth into your application.

Prerequisites

Understand OAuth 2.0 basics, including:

  • Authorization server
  • Client application
  • Resource owner
  • Access token

Register your application

Register your application to receive OAuth credentials. Submit your project details using the application form. After approval, you’ll receive credentials and additional information needed to implement OAuth 2.0.



Submit your app

OAuth 2.0 flow

Brevo uses the OAuth 2.0 authorization code grant flow to create access tokens on behalf of users. The flow authorizes applications to access and manipulate user data, such as sending emails or updating contacts.

OAuth grant flow for Brevo apps

Flow steps

  1. User accesses your private integration application
  2. Your app loads the Brevo authentication popup window
  3. User authenticates with Brevo credentials (email/password, Google, or Apple)
  4. Your app requests an access token from the Brevo Auth Server
  5. The Brevo Auth Server validates the request and returns OAuth tokens:
    • Access token: Bearer token included in the Authorization header for subsequent API requests
    • Refresh token: Used to obtain a new access token when the current one expires
  6. Your app stores the credentials and proceeds to make API calls
  7. For each API request, the Brevo Auth Server validates the bearer token and returns the requested data