Ghost docs
OAuth apps

URL generator

Build an authorize URL and the matching token request without writing code

Fill in your app's details to get the URL that starts the sign-in, and the request your server makes once Ghost sends the person back. Everything is computed in your browser; nothing you type is sent anywhere.

Where Ghost's API answers, with https://
From your app's page under Settings → OAuth apps
Leave empty to use the app's first callback URL
Scopes

Ask for the fewest your app needs.

Random per request. Check it comes back unchanged.
Secret. Store it server-side until the callback arrives.
1. Send the person to this URLOpen in a new tab
https://api.example.com/login/oauth/authorize?client_id=YOUR_CLIENT_ID&scope=repo
2. Exchange the code from the callback, on your server
curl -X POST https://api.example.com/login/oauth/access_token \  -H "Accept: application/json" \  -d client_id=YOUR_CLIENT_ID \  -d client_secret="$GHOST_CLIENT_SECRET" \  -d code=CODE_FROM_THE_CALLBACK

Trying it by hand

  1. Register an app under Settings → OAuth apps, and copy its client ID here.
  2. Open the URL in a browser where you are signed in to Ghost, and approve the app.
  3. Ghost redirects to your callback. If nothing listens there yet, copy the code from the address bar of the page that fails to load.
  4. Within 10 minutes, run the curl command with that code and your client secret in GHOST_CLIENT_SECRET. A code works once, and a failed exchange uses it up.

See Authorizing users and Exchanging the code for what each parameter means.

Managing and revoking access

Rotate the secret, change the app, and how people revoke it

Examples

Complete sign-in flows in Node.js and Python, a device-flow script for the shell, and calling the API with Octokit

On this page

Trying it by hand