How do I authenticate with the FieldPulse API using OAuth?

Question

Need OAuth flow for API access. Docs mention authorization code but no example. Is it standard PKCE or client credentials? What endpoints?

Also need token refresh details — expiry time, refresh token validity.

Eli Torres (Staff) · Accepted Answer

Hey Carlos — yeah this one tripped me up too when I first looked at it. We use the authorization code flow with PKCE for the public API. No client credentials grant at the moment. Here's the flow: 1. Authorization request GET api.fieldpulse.io/.../authorize 
 response_type=code&
 client_id={your_client_id}&
 redirect_uri= https://yourapp.com/callback& 
 scope=api:read api:write&
 code_challenge={S256_hash_of_verifier}&
 code_challenge_method=S256&
 state={random_state} 2. Token exchange POST api.fieldpulse.io/.../token 
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&
 code={authorization_code}&
 redirect_uri= https://yourapp.com/callback& 
 client_id={your_client_id}&
 code_verifier={your_original_verifier} Token lifetimes: Access token: 1 hour (3600 seconds) Refresh token: 30 days Refresh token is single-use — you'll get a new one with each refresh. Store it securely because if you lose it, the user has to re-auth. For full reference: Using the FieldPulse API and API Rate Limits and Best Practices. Let me know if you hit any weirdness with the code_challenge — we had a bug a few months back where trailing newlines in the verifier weren't being stripped consistently, but should be fixed as of the 3.2 release.

Leo Nakamura · Answer

PKCE required, no fallback Scope format: space-delimited strings, not arrays Redirect URI must match registration exactly — trailing slash matters Rate limit on /oauth/token: 10 requests/minute per client_id See SSO docs for related SAML constraints if you're also doing identity.