Exchange User Consent for API Access

Ruba supports the OAuth 2.0 authorization-code flow with OpenID Connect. The user approves requested scopes in Ruba, your callback receives a one-use code, and your server exchanges it for tokens.

https://getruba.com/oauth2/authorize?
  response_type=code
  &client_id=CLIENT_ID
  &redirect_uri=https%3A%2F%2Fexample.com%2Fcallback
  &scope=openid%20email

Parameter	Requirement
`response_type=code`	Required; authorization code is the only supported flow
`client_id`	The identifier issued with the OAuth client
`redirect_uri`	An exact callback URI registered on that client
`scope`	Space-separated scopes that are also allowed by the client configuration

These fields follow the OpenID Connect authorization request.

The resulting token acts as the consenting user. During consent, that user may restrict it to selected organizations; otherwise it covers all organizations they can access, including ones joined later. Access always follows current membership, so leaving an organization removes access. Token introspection returns the restriction in organizations; an empty array means no explicit organization restriction. After approval, Ruba redirects to redirect_uri?code=....

2. Exchange the one-use code

A confidential client sends its ID and secret to the token endpoint:

curl -X POST https://api.getruba.com/v1/oauth2/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=authorization_code&code=AUTHORIZATION_CODE&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&redirect_uri=https://example.com/callback'

{
  "token_type": "Bearer",
  "access_token": "ruba_at_XXX",
  "expires_in": 864000,
  "refresh_token": "ruba_rt_XXX",
  "scope": "openid email",
  "id_token": "ID_TOKEN"
}

Use access_token for API calls, retain refresh_token to obtain another access token after expiry, and validate id_token as the signed user identity described by the OpenID Connect ID Token specification.

Public clients use PKCE

An SPA, mobile app, or device application cannot keep a client secret. When the OAuth client is explicitly configured as public, omit client_secret and complete PKCE instead. Confidential clients must not use this exception.

3. Call the API

Place the access token in the Bearer authorization header:

curl -X GET https://api.getruba.com/v1/oauth2/userinfo \
  -H 'Authorization: Bearer ruba_at_XXX'

Launch Path

Shape the Offer

Run the Revenue Model

Deliver Customer Access

Build the Integration

Operate the Business

Implementation Playbooks

Exchange User Consent for API Access

2. Exchange the one-use code

Public clients use PKCE

3. Call the API

​1. Send the user to consent

​2. Exchange the one-use code

​Public clients use PKCE

​3. Call the API

1. Send the user to consent

2. Exchange the one-use code

Public clients use PKCE

3. Call the API