OAuth and authentication

1. Build the authorize URL

Send the creator to this URL in their browser:

https://furipay.me/oauth/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=https%3A%2F%2Fyourapp.com%2Fcallback&scope=profile.read+tips.read&state=RANDOM_CSRF_TOKEN

• redirect_uri must exactly match a registered HTTPS URL.
• scope is space-separated; request only permissions the app uses.
• state must be random per request, stored server-side, and compared in constant time after the redirect.

After approval, Furipay redirects back with code and state. The authorization code expires after five minutes and can be used only once.

2. Exchange the code

Call this endpoint from your server only:

POST https://api.furipay.me/v1/oauth/token
Content-Type: application/json

{
  "grant_type": "authorization_code",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "code": "RETURNED_CODE",
  "redirect_uri": "https://yourapp.com/callback"
}

curl -X POST \
  'https://api.furipay.me/v1/oauth/token' \
  -H 'Authorization: Bearer <token>'

Successful responses have this shape:

{
  "access_token": "eyJ...",
  "refresh_token": "fp_ref_...",
  "token_type": "Bearer",
  "expires_in": 31536000,
  "scope": "profile.read tips.read"
}

Treat expires_in from the response as the source of truth for token lifetime and store both tokens encrypted.

3. Refresh tokens

POST https://api.furipay.me/v1/oauth/token
Content-Type: application/json

{
  "grant_type": "refresh_token",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "refresh_token": "fp_ref_..."
}

Each refresh returns a new refresh token. Store the new value atomically and stop using the old one immediately.

Scopes

GET /me requires no additional scope, but it still requires a valid access token.