The short answer: OAuth is a standard authorization protocol that lets you securely connect external systems to your Proof account without sharing passwords. Here's how to create an OAuth client application to get started.
Only organization owners, admins, or users with API management permissions can create OAuth client applications. Read the OAuth developer docs for technical details.
How it works
Instead of sharing a username and password, OAuth uses tokens that provide specific, limited permissions. A common example is signing in with Google or Apple. In Proof, OAuth is offered as an alternative to API keys.
To use OAuth, you create a client application. You can create an unlimited number of client applications. Each client application:
- Has one unique App ID
- Can have multiple random App secrets
- Has a scope equivalent to a full-access API key
App secrets:
- Are displayed to you only once — copy and store them immediately
- Show the date and time of creation
- Can be deleted unless they're the only secret associated with the client application
OAuth tokens expire every 2 hours.
Common use cases
- Integrating external systems with the Proof API
- Automating transaction creation workflows
- Managing API authentication without sharing account credentials
- Supporting secure third-party integrations
- Separating production and sandbox API environments
Security considerations
- Store OAuth client secrets in a secure credential management system.
- Never expose OAuth secrets in source code repositories or client-side applications.
- Rotate client secrets regularly according to your organization's security policies.
- Revoke unused or compromised secrets immediately.
Create an OAuth client application
- Select Settings from the menu on the left.
- Select OAuth from the Settings page menu.
- Type the name of the client application.
- Select Create client application.
-
Select Copy to clipboard to copy the secret.
- Be sure to copy the secret — it will not be visible once you navigate away from this page.
Troubleshooting
- If your integration cannot authenticate, verify the correct App ID and secret are being used.
- OAuth client secrets are only visible once after creation.
- Expired OAuth tokens must be refreshed through the OAuth flow.
- Ensure OAuth has been enabled for your organization before attempting to create a client application.
Summary Checklist
- OAuth must be enabled by Proof before you can create a client application — contact your CSM or sales.
- Navigate to Settings → OAuth, name the application, and select Create client application.
- Copy the client secret immediately — it's shown only once and cannot be recovered if lost.
- Store secrets securely and rotate them regularly. OAuth tokens expire every 2 hours.
Updated