How do I authenticate with the FieldPulse API using OAuth?

Hey Carlos — yeah this one tripped me up too when I first looked at it. We use the authorization code flow with PKCE for the public API. No client credentials grant at the moment.

Here's the flow:

1. Authorization request

GET api.fieldpulse.io/.../authorize
  response_type=code&
  client_id={your_client_id}&
  redirect_uri=https://yourapp.com/callback&
  scope=api:read api:write&
  code_challenge={S256_hash_of_verifier}&
  code_challenge_method=S256&
  state={random_state}

2. Token exchange

POST api.fieldpulse.io/.../token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&
  code={authorization_code}&
  redirect_uri=https://yourapp.com/callback&
  client_id={your_client_id}&
  code_verifier={your_original_verifier}

Token lifetimes:

• Access token: 1 hour (3600 seconds)
• Refresh token: 30 days

Refresh token is single-use — you'll get a new one with each refresh. Store it securely because if you lose it, the user has to re-auth.

For full reference: Using the FieldPulse API and API Rate Limits and Best Practices.

Let me know if you hit any weirdness with the code_challenge — we had a bug a few months back where trailing newlines in the verifier weren't being stripped consistently, but should be fixed as of the 3.2 release.

Hey Carlos — yeah this one tripped me up too when I first looked at it. We use the authorization code flow with PKCE for the public API. No client credentials grant at the moment.

Here's the flow:

1. Authorization request

GET api.fieldpulse.io/.../authorize
  response_type=code&
  client_id={your_client_id}&
  redirect_uri=https://yourapp.com/callback&
  scope=api:read api:write&
  code_challenge={S256_hash_of_verifier}&
  code_challenge_method=S256&
  state={random_state}

2. Token exchange

POST api.fieldpulse.io/.../token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&
  code={authorization_code}&
  redirect_uri=https://yourapp.com/callback&
  client_id={your_client_id}&
  code_verifier={your_original_verifier}

Token lifetimes:

• Access token: 1 hour (3600 seconds)
• Refresh token: 30 days

Refresh token is single-use — you'll get a new one with each refresh. Store it securely because if you lose it, the user has to re-auth.

For full reference: Using the FieldPulse API and API Rate Limits and Best Practices.

Let me know if you hit any weirdness with the code_challenge — we had a bug a few months back where trailing newlines in the verifier weren't being stripped consistently, but should be fixed as of the 3.2 release.

Got it. PKCE with S256. What's the exact byte length you expect for the code_verifier? RFC 7636 says 43-128 chars base64url but seeing 400 errors at 128.

We cap at 64 bytes of randomness (86 chars base64url). Overshoot that and you'll hit the 400. Try generating with 32 bytes — that's what our own SDK uses:

import crypto from 'crypto';
const verifier = crypto.randomBytes(32).toString('base64url');

Docs should mention this, honestly. I'll flag it.