OAuth Apps
Use OAuth Apps when your product needs a Log in with One Horizon or Connect One Horizon flow.
After a workspace member approves your app, your app receives user-scoped tokens. Use those tokens to read workspace data or take workspace actions the member is allowed to take, such as listing initiatives, creating comments, updating bugs, or starting agent sessions.
When to use OAuth
Use OAuth when your app needs a person to approve access from their own One Horizon account. This is the right model for customer-facing apps, MCP clients, agent integrations, and tools that need to show who took an action.
Use an API key when a trusted backend service or CI job should act for one workspace without a signed-in user.
| Need | Use |
|---|---|
| Add Log in with One Horizon to your app | OAuth app |
| Let users connect their workspace to your product | OAuth app |
| Read or update data as the signed-in member | OAuth access token |
| Run internal automation for one workspace | Workspace API key |
| Build a local or cloud agent | OAuth app plus agent endpoints |
App setup
Workspace admins manage apps from Settings -> Apps. A custom app can include homepage, logo, privacy policy, terms URL, callback URLs, OAuth settings, client ID, and client secret.
Public clients use PKCE directly. Confidential clients can use a client secret, and selected confidential clients can use dashboard-managed PKCE when they cannot originate PKCE themselves.
Create separate apps for production and staging so callback URLs, secrets, webhook keys, and delivery logs stay isolated.
OAuth settings
Add each callback URL that your app can return to after authorization. Keep callback URLs exact; do not rely on broad redirects.
Public clients should use PKCE and should not embed a secret. Confidential clients should store the client secret on the server only. If the app cannot originate PKCE itself, use dashboard-managed PKCE only for the clients that need it.
OAuth clients created automatically by tools such as MCP or the CLI can also appear in app management so users can inspect or revoke access.
User control
Users can review connected OAuth clients and revoke access when they no longer need an app. Revoking access stops that app from using the user's token for workspace data or actions.
OAuth apps are managed from Apps and governed by Permissions.