Inflection Connected Apps using oAuth 2.1

Feature	Description
OAuth 2.1	Latest OAuth standard with security best practices
PKCE Required	Protects against authorization code interception attacks
Refresh Tokens	Automatically renew access without re-authentication
Secure Access	Token-based authentication for all API calls

Use Case	Authentication Method
Custom app integrations	✅ OAuth 2.1 (this guide)
Automation platforms (n8n, Zapier)	✅ OAuth 2.1 (this guide)
API testing (Postman)	✅ OAuth 2.1 (this guide)
Internal scripts and tools	✅ OAuth 2.1 (this guide)
Inflection Developer API calls	✅ OAuth 2.1 (this guide) — or a PAT
Claude AI assistant	❌ Use MCP with DCR
ChatGPT integration	❌ Use MCP with DCR
Other MCP DCR compatible AI	❌ Use MCP with DCR

Step 1: Create a Connected App

Log in to your Inflection account
Navigate to Settings → Connected Apps
Click Create App Credentials
Fill in the required fields:

Field	Description	Example
App Name	A descriptive name for your application	”My Integration App”
Redirect URL(s)	The URL where users will be redirected after authentication	`https://your-app.com/callback` or `http://localhost:3000/callback`
Description	Optional description of your app’s purpose	”Integration for marketing automation”

Click Connect to create the app

Important: Save Your Credentials

After creating the app, you will receive:

Client ID - A public identifier for your app
Client Secret - A confidential key (keep this secure!)

Store these credentials securely. The Client Secret will not be shown again.

Step 2: OAuth 2.1 Endpoints

Use these endpoints for authentication (you can also discover these via the well-known endpoint):

Endpoint	URL
Authorization	`https://auth-v2.inflection.io/oauth2/authorize`
Token	`https://auth-v2.inflection.io/oauth2/token`

Step 3: Authorization Code Flow with PKCE

OAuth 2.1 requires PKCE for enhanced security. Here’s how the flow works:

3.1 Generate PKCE Parameters

Before starting the flow, generate these values:

Code Verifier: A cryptographically random string (43-128 characters)
Code Challenge: Base64-URL encoded SHA256 hash of the code verifier

Example (JavaScript):

// Generate code verifier
function generateCodeVerifier() {
  const array = new Uint8Array(32);
  crypto.getRandomValues(array);
  return btoa(String.fromCharCode(...array))
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=/g, '');
}

// Generate code challenge
async function generateCodeChallenge(verifier) {
  const encoder = new TextEncoder();
  const data = encoder.encode(verifier);
  const digest = await crypto.subtle.digest('SHA-256', data);
  return btoa(String.fromCharCode(...new Uint8Array(digest)))
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=/g, '');
}

3.2 Request Authorization

Direct the user to the authorization URL:

https://auth-v2.inflection.io/oauth2/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REDIRECT_URI
  &code_challenge=YOUR_CODE_CHALLENGE
  &code_challenge_method=S256
  &scope=inflection_app

Parameter	Required	Description
response_type	Yes	Must be `code`
client_id	Yes	Your app’s Client ID
redirect_uri	Yes	Must match the registered redirect URL
code_challenge	Yes	The PKCE code challenge
code_challenge_method	Yes	Must be `S256`
scope	Yes	Must be `inflection_app`

3.3 Handle the Callback

After the user authorizes your app, they will be redirected to your redirect URL with an authorization code:

YOUR_REDIRECT_URI?code=AUTHORIZATION_CODE

3.4 Exchange Code for Tokens

Make a POST request to exchange the authorization code for tokens:

curl -X POST https://auth-v2.inflection.io/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "redirect_uri=YOUR_REDIRECT_URI" \
  -d "code=AUTHORIZATION_CODE" \
  -d "code_verifier=YOUR_CODE_VERIFIER"

3.5 Token Response

A successful response returns:

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOi...",
  "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Field	Description
access_token	Use this to authenticate API requests
refresh_token	Use this to get new access tokens
token_type	Always “Bearer”
expires_in	Token lifetime in seconds

Step 4: Using the Access Token

Include the access token in the Authorization header for all API requests:

curl -X POST https://campaign.inflection.io/api/v1/campaigns/campaign.list \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"page_size": 30, "page_number": 1}'

The same token works on the Developer API, and it acts as the user who authorized the app (see Authentication):

curl https://api.inflection.io/v1/contacts/by-email/jane%40acme.com \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Step 5: Refreshing Tokens

When your access token expires, use the refresh token to get a new one:

curl -X POST https://auth-v2.inflection.io/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "refresh_token=YOUR_REFRESH_TOKEN"

Integration Examples

Postman Setup

Create a new request in Postman
Go to the Authorization tab
Select OAuth 2.0 as the type
Configure with these settings:

Setting	Value
Grant Type	Authorization Code (With PKCE)
Callback URL	`https://oauth.pstmn.io/v1/browser-callback`
Auth URL	`https://auth-v2.inflection.io/oauth2/authorize`
Access Token URL	`https://auth-v2.inflection.io/oauth2/token`
Client ID	Your Client ID
Client Secret	Your Client Secret
Code Challenge Method	SHA256

Click Get New Access Token
Complete the login in your browser
Use the token to make API requests

Note: Ensure the Callback URL (https://oauth.pstmn.io/v1/browser-callback) is added as a Redirect URL in your Connected App settings.

n8n Setup

Prerequisite: Make sure you have created an app in inflection for n8n (shared above)

Use the MCP Client (If you want to use the MCP) or create and HTTP Request (If you want to use an API)
Set Authentication to MCP OAUTH2 or Generic Credential Type (OAuth2)
Configure a new OAuth2 credential:

Setting	Value
Grant Type	PKCE
Authorization URL	`https://auth-v2.inflection.io/oauth2/authorize`
Access Token URL	`https://auth-v2.inflection.io/oauth2/token`
Client ID	Your Client ID
Client Secret	Your Client Secret
Scope	`inflection_app`

n8n OAuth2 credential configuration fields

Click Connect to authorize
n8n will automatically handle token refresh

Security Best Practices

Never expose your Client Secret in client-side code or public repositories
Use HTTPS for all redirect URLs in production
Store tokens securely - use encrypted storage or secure vaults
Implement token refresh before expiration to ensure uninterrupted access
Use short-lived access tokens and rely on refresh tokens for extended sessions
Validate redirect URIs match exactly what’s registered in your app

Overview

Inflection MCP

Integrations

Inflection Connected Apps using oAuth 2.1

About This Guide

Scope of This Documentation

MCP Authentication (Claude, ChatGPT, etc.)

Overview

Key Features

When to Use This Authentication Method

Prerequisites

Important: Save Your Credentials

3.1 Generate PKCE Parameters

3.2 Request Authorization

3.3 Handle the Callback

3.4 Exchange Code for Tokens

3.5 Token Response

Tips

​About This Guide

​Scope of This Documentation

​MCP Authentication (Claude, ChatGPT, etc.)

​Overview

​Key Features

​When to Use This Authentication Method

​Prerequisites

​Important: Save Your Credentials

​3.1 Generate PKCE Parameters

​3.2 Request Authorization

​3.3 Handle the Callback

​3.4 Exchange Code for Tokens

​3.5 Token Response

​Tips

About This Guide

Scope of This Documentation

MCP Authentication (Claude, ChatGPT, etc.)

Overview

Key Features

When to Use This Authentication Method

Prerequisites

Important: Save Your Credentials

3.1 Generate PKCE Parameters

3.2 Request Authorization

3.3 Handle the Callback

3.4 Exchange Code for Tokens

3.5 Token Response

Tips