OAuth apps

1. 1In PostNimbo open Settings > Apps and create an OAuth app with its name, description, picture and redirect address.
2. 2Copy the client id and client secret. Keep the secret on your server; rotate it from the same page if it leaks.

Send the member to the consent screen with your client id, the redirect address, a state value and, recommended for every app and required for apps that cannot keep a secret, a PKCE S256 challenge.

https://postnimbo.com/oauth/authorize
  ?client_id=<client id>
  &response_type=code
  &redirect_uri=<your redirect address>
  &state=<random value>
  &code_challenge=<base64url(sha256(verifier))>
  &code_challenge_method=S256
  &scope=posts:read posts:schedule

After they approve, PostNimbo redirects to your address with code and state. Check the state, then exchange the code within a few minutes:

curl -X POST https://postnimbo.com/api/oauth/token \
  -d grant_type=authorization_code \
  -d code=<code> \
  -d client_id=<client id> \
  -d client_secret=<client secret> \
  -d code_verifier=<verifier> \
  -d redirect_uri=<your redirect address>

{
  "access_token": "pos_…",
  "token_type": "bearer",
  "scope": "posts:read posts:schedule"
}

Send the access token in the Authorization header of the REST API. It keeps working until the member revokes your app; store it encrypted.

Ask only for what your app uses. The consent screen lists each one in these words. Asking for none of them gives the token full access, so prefer scopes.

• ideas:writeSave ideas to your Ideas board, and remove ideas you saved (Undo)
• media:writeAdd images to your media library
• posts:readSee your brands, channels, scheduled posts and the posts waiting for approval
• posts:scheduleSchedule posts to your channels (when your workspace asks for approval, your approvers get them first)
• ai:useWrite drafts with PostNimbo AI, within your plan's AI features
• link-in-bio:writeAdd links to your link-in-bio pages
• analytics:readSee a summary of your analytics
• inbox:readSee how many inbox conversations are unread
• webhooks:writeSend an event to an address you choose (like Zapier, Make or n8n) when a post is published, a flow captures a lead (with its email or phone number) or a flow is completed

• It acts as the member who approved it: only their brands and channels, and the channel levels their workspace gave them.
• When the workspace asks for approval, posts it schedules wait for the approvers like the member’s own.
• A route outside its scopes answers 403. Ask the member to sign in again to grant more.