OAuth 2.0

Dashboard login (people)

1. Username / password — register + login; first-party access + refresh tokens.
2. Google / Apple OIDC — authorization code + PKCE → session cookie.

Do not send Google/Apple IdP tokens to /v1.

API and MCP (apps and agents)

Growth and Premium. Call /v1 and https://mcp.litonl.com with:

Authorization: Bearer ACCESS_TOKEN

Flow	Use
Authorization code + PKCE	Third-party apps for a logged-in user
Client credentials	Scripts, backends, MCP — no browser

On Growth/Premium upgrade we create one OAuth client per organization. Same client for REST and MCP. Rotate from the dashboard.

Endpoints

Endpoint	Role
GET /oauth/authorize	Auth code + PKCE
POST /oauth/token	Exchange code or client credentials
POST /oauth/revoke	Revoke access or refresh token

Client credentials example

curl -sS -X POST https://litonl.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=lit_id_..." \
  -d "client_secret=lit_sec_..." \
  -d "scope=links:write webhooks:write"

Then:

curl -sS -X POST https://litonl.com/v1/links \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/launch"}'

Next: API reference · AI agents