OAuth apps

All path parameters are required.

We support OAuth 2.0 with PKCE. Third-party applications register an OAuth app, redirect users through a consent screen, exchange the resulting authorization code for tokens, and call the API on behalf of those users. All token traffic uses bearer tokens in the standard Authorization header.

These endpoints cover three areas: managing OAuth applications (registration, update, deletion), the authorization flow (consent screen, code exchange, token refresh, revocation), and reviewing or revoking grants that users have already approved.

---

Applications

List OAuth applications

GET/v1/oauth/applicationsList OAuth applications

Query parameters

Name	Type	Required	Description
q	string		Quick search by name or ID
id	string[]		List of application IDs to filter
name	string		Filter by application name
description	string		Filter by application description
active	boolean		Filter by active status
redirect_uri	string		Filter by redirect URI (contains match)
owner	string		Filter by owner user ID
limit	integer		How many items to return
page	integer		Page number to fetch
sort	string		Field to order by
dir	string		Order direction (ASC/DESC)
after	string		Forward keyset cursor (for keyset pagination)
before	string		Backward keyset cursor (for keyset pagination)

Lists all registered OAuth applications. Supports pagination and quick search by name or ID, plus filtering by owner user ID.

Administrator only.

curl https://api.galaxygate.net/v1/oauth/applications \
  -A 'curl/8.5' \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN"

Returns 200 OK with a paged list of OAuth application objects.

---

Register an OAuth application

POST/v1/oauth/applicationsRegister a new OAuth application

Creates a new OAuth application. The client_secret is returned only in this response. It cannot be retrieved again. Save it securely. Rotate it with POST /v1/oauth/applications/{apid}/secret if it is ever exposed.

Administrator only.

Request body

Field	Type	Required	Description
name	string	yes	Application name (4-128 characters)
description	string or null		Application description (up to 1024 characters)
redirect_uris	string[]	yes	Allowed redirect URIs. At least one URI. HTTPS required. HTTP is permitted for localhost and 127.0.0.1. Fragments are forbidden.
scopes	string[]	yes	Nonempty set of available scopes this application may request

Returns 200 OK with the application creation response, including client_id and the one-time client_secret.

---

Fetch an OAuth application

GET/v1/oauth/applications/{apid}Get an OAuth application

Returns the full detail for a single OAuth application.

Administrator only.

Path parameters

Name	Type	Description
apid	string	Application ID

Returns 200 OK with the application object. The client_secret is never returned on reads.

---

Update an OAuth application

PATCH/v1/oauth/applications/{apid}Update an OAuth application

Updates the application. All fields are optional. Send only what you are changing. Null leaves a field unchanged. Only the application owner may update it.

Administrator only.

Path parameters

Name	Type	Description
apid	string	Application ID

Request body

Field	Type	Description
name	string or null	Application name (4-128 characters)
description	string or null	Application description (up to 1024 characters)
redirect_uris	string[] or null	Updated list of allowed redirect URIs
scopes	string[] or null	Updated set of available scopes
active	boolean or null	Set to false to suspend the application without deleting it

Returns 200 OK with the updated application object.

---

Delete an OAuth application

DELETE/v1/oauth/applications/{apid}Delete an OAuth application

Deletes the application and cascades to all authorization records, codes, and tokens issued to it. This cannot be undone. Only the application owner may delete it.

Administrator only.

Path parameters

Name	Type	Description
apid	string	Application ID

Returns 202 Accepted with an empty body.

---

Regenerate a client secret

POST/v1/oauth/applications/{apid}/secretRegenerate the client secret

Requires administrator access and application ownership. Rotates the client secret. The new plaintext secret is returned only in this response. The old secret is invalidated immediately.

Path parameters

Name	Type	Description
apid	string	Application ID

Returns 200 OK

Field	Type	Description
client_secret	string	New client secret. Only returned once

---

List your own OAuth applications

GET/v1/users/{uid}/oauth-appsList OAuth applications you own

Path parameters

Name	Type	Required	Description
uid	string	yes	User ID, or @me for the current user

Query parameters

Name	Type	Required	Description
q	string		Quick search by name or ID
id	string[]		List of application IDs to filter
name	string		Filter by application name
description	string		Filter by application description
active	boolean		Filter by active status
redirect_uri	string		Filter by redirect URI (contains match)
owner	string		Filter by owner user ID
limit	integer		How many items to return
page	integer		Page number to fetch
sort	string		Field to order by
dir	string		Order direction (ASC/DESC)
after	string		Forward keyset cursor (for keyset pagination)
before	string		Backward keyset cursor (for keyset pagination)

Lists the OAuth applications owned by the given user. Use @me for the authenticated user. Other users require staff access. Supports pagination and quick search by name or ID.

Returns 200 OK with a paged list of application objects.

---

Authorization flow

The standard PKCE flow is:

1. Your app generates a code_verifier and computes code_challenge = base64url(SHA-256(code_verifier)).
2. Redirect the user to the panel's /oauth/authorize page with the parameters described below. The panel calls GET /v1/oauth/authorize to populate its consent screen.
3. The user approves or denies. The panel calls POST /v1/oauth/authorize and then redirects the user back to your redirect_uri with a code query parameter.
4. Your server exchanges the code for tokens via POST /v1/oauth/token.
5. Use the access_token as a bearer token. When it expires, use the refresh_token to obtain a new pair.

---

Get consent screen info

GET/v1/oauth/authorizeFetch consent screen details

Returns the application details and requested scopes that the panel uses to render the consent screen. The user must be logged in.

Query parameters

Name	Type	Required	Description
client_id	string	yes	Application client identifier
redirect_uri	string	yes	Must match a registered redirect URI
scope	string	yes	Space-delimited list of available scopes
response_type	string	yes	Must be code
code_challenge	string	yes	base64url(SHA-256(code_verifier))
code_challenge_method	string	yes	Must be S256

Returns 200 OK

Field	Type	Description
application	object	Application summary: id, name, description
requested_scopes	string[]	Scopes the application is asking for
previously_approved_scopes	string[]	Scopes this user already approved for this app (empty on first authorization)

---

Approve or deny an authorization request

POST/v1/oauth/authorizeSubmit the consent decision

Called after the user makes a consent decision on the panel's consent screen. The user must be logged in.

Request body

Field	Type	Required	Description
client_id	string	yes	Application client identifier
redirect_uri	string	yes	Must match a registered redirect URI
response_type	string	yes	Must be code
scope	string[]	yes	Available scopes the user is approving
state	string	yes	Opaque value from the original authorization request. Echoed back in the redirect
code_challenge	string	yes	base64url(SHA-256(code_verifier))
code_challenge_method	string	yes	Must be S256
approve	boolean	yes	true to approve. false to deny

Returns 200 OK

Field	Type	Description
redirect_uri	string	The redirect URI with code and state appended (on approval), or error and error_description (on denial)

---

Exchange a code or refresh a token

POST/v1/oauth/tokenExchange code or refresh token for access tokens

OAuth 2.0 token endpoint. The request body must be application/x-www-form-urlencoded. No bearer token is required. The client authenticates via client_id and client_secret in the form body.

No authentication required.

Form body - authorization_code grant

Field	Type	Required	Description
grant_type	string	yes	authorization_code
client_id	string	yes	Application client identifier
client_secret	string	yes	Application client secret
code	string	yes	Authorization code from the redirect
redirect_uri	string	yes	Must match the URI used in the authorization request
code_verifier	string	yes	PKCE verifier that was hashed to produce code_challenge

Form body - refresh_token grant

Field	Type	Required	Description
grant_type	string	yes	refresh_token
client_id	string	yes	Application client identifier
client_secret	string	yes	Application client secret
refresh_token	string	yes	Refresh token from a previous grant or refresh

# Exchange authorization_code
curl -X POST https://api.galaxygate.net/v1/oauth/token \
  -A 'curl/8.5' \
  --data-urlencode grant_type=authorization_code \
  --data-urlencode client_id=gg_client_... \
  --data-urlencode client_secret=gg_secret_... \
  --data-urlencode 'code=<code>' \
  --data-urlencode redirect_uri=https://yourapp.example.com/callback \
  --data-urlencode 'code_verifier=<verifier>'

Returns 200 OK

Field	Type	Description
access_token	string	Bearer token to use in API calls
token_type	string	Always Bearer
expires_in	integer	Lifetime of the access token in seconds
refresh_token	string	Token to use when refreshing. Present on both initial grant and refresh
scope	string	Granted scopes, space-delimited

Invalid client credentials return 401 Unauthorized. Other token-exchange errors return 400 Bad Request with a JSON body containing error and error_description.

---

Revoke a token

POST/v1/oauth/revokeRevoke an access or refresh token

RFC 7009 token revocation. The request body must be application/x-www-form-urlencoded. Always returns 200 OK regardless of whether the token was found or the client credentials were valid.

No authentication required.

Form body

Field	Type	Required	Description
token	string	yes	Access or refresh token to revoke
client_id	string	yes	Application client identifier
client_secret	string	yes	Application client secret

Returns 200 OK with an empty body.

---

Authorizations

An authorization record is created the first time a user approves a consent screen for an application. Revoking it invalidates all access and refresh tokens issued to that application for that user.

List your authorized apps

GET/v1/oauth/authorizationsList apps you have authorized

Query parameters

Name	Type	Required	Description
q	string		Quick search by application name or ID
id	string[]		List of authorization IDs to filter
name	string		Filter by application name
application	string		Filter by application ID
user	string		Filter by user ID
scope	string		Filter by scope (exact match, e.g. Instance:read). Values: app:read, app:write, audit:read, dedibox:read, dedibox:write, disk:read, disk:write, floating_ip:read, floating_ip:write, image:read, image:write, instance:read, instance:write, net_balancer:read, net_balancer:write, workspace:read, workspace:write.
limit	integer		How many items to return
page	integer		Page number to fetch
sort	string		Field to order by
dir	string		Order direction (ASC/DESC)
after	string		Forward keyset cursor (for keyset pagination)
before	string		Backward keyset cursor (for keyset pagination)

Lists all OAuth applications the authenticated user has approved. Supports pagination and quick search by application name, plus filtering by application ID. Each entry shows the application, the approved scopes, and when the authorization was granted.

Returns 200 OK with a paged list of authorization objects.

---

Revoke an authorization

DELETE/v1/oauth/authorizations/{auid}Revoke an app authorization

Revokes an authorization and deletes all access and refresh tokens the application holds for this user. The application will need to go through the consent screen again to regain access.

Path parameters

Name	Type	Description
auid	string	Authorization ID

Returns 202 Accepted with an empty body.

---

List all authorizations (admin)

GET/v1/oauth/admin/authorizationsList all authorizations across all users

Query parameters

Name	Type	Required	Description
q	string		Quick search by application name or ID
id	string[]		List of authorization IDs to filter
name	string		Filter by application name
application	string		Filter by application ID
user	string		Filter by user ID
scope	string		Filter by scope (exact match, e.g. Instance:read). Values: app:read, app:write, audit:read, dedibox:read, dedibox:write, disk:read, disk:write, floating_ip:read, floating_ip:write, image:read, image:write, instance:read, instance:write, net_balancer:read, net_balancer:write, workspace:read, workspace:write.
limit	integer		How many items to return
page	integer		Page number to fetch
sort	string		Field to order by
dir	string		Order direction (ASC/DESC)
after	string		Forward keyset cursor (for keyset pagination)
before	string		Backward keyset cursor (for keyset pagination)

Lists every OAuth authorization across all users. Supports pagination and filtering by user ID, application ID, application name, and scope.

Administrator only.

Returns 200 OK with a paged list of full authorization objects, each including the owning user.

Response objects

Application object

Field	Type	Description
active	boolean	Whether this application is active
client_id	string	Public client identifier
created	string (ISO 8601)	When this application was registered
description	string or null	Application description
id	string	Application ID
name	string	Application name
owner	object	Staff member who registered this application
redirect_uris	string[]	Allowed redirect URIs
scopes	string[]	Available scopes allowed for this application

Application creation response

Field	Type	Description
active	boolean	Whether the application is active
client_id	string	Public client identifier
client_secret	string	Client secret, save it securely. Only returned once.
created	string (ISO 8601)	When the application was registered
description	string	Application description
id	string	Application ID
name	string	Application name
redirect_uris	string[]	Allowed redirect URIs
scopes	string[]	Available scopes allowed for this application

Authorization object

Field	Type	Description
application	object	OAuth application that was authorized
created	string (ISO 8601)	When this authorization was granted
id	string	Authorization ID
last_used	string (ISO 8601) or null	When this authorization was last used
scopes	string[]	Approved scopes

The administrator authorization response also includes a user object with the approving user's id and name.