> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inflection.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Inflection Connected Apps using oAuth 2.1

> Connect to Inflection's MCP server.

This guide explains how to set up OAuth 2.1 authentication for general-purpose MCP access to the Inflection platform.

## About This Guide

### Scope of This Documentation

This guide covers **general-purpose OAuth 2.1 authentication** for:

* Custom integrations and applications
* Third-party automation tools (n8n, Zapier, Make, etc.)
* API testing tools (Postman, Insomnia, etc.)
* Custom scripts and internal tooling
* Calling the [Inflection Developer API](/api-reference/introduction)

### MCP Authentication (Claude, ChatGPT, etc.)

If you're looking to connect Inflection with **AI assistants via MCP (Model Context Protocol)**, such as:

* Claude (Anthropic)
* ChatGPT (OpenAI)

Please refer to the specific **MCP Integration Guide** for ChatGPT and Claude

## Overview

Inflection uses **OAuth 2.1 with PKCE** (Proof Key for Code Exchange) for secure API authentication. This modern authentication standard provides enhanced security for both web and native applications.

### Key Features

| Feature        | Description                                              |
| -------------- | -------------------------------------------------------- |
| OAuth 2.1      | Latest OAuth standard with security best practices       |
| PKCE Required  | Protects against authorization code interception attacks |
| Refresh Tokens | Automatically renew access without re-authentication     |
| Secure Access  | Token-based authentication for all API calls             |

### When to Use This Authentication Method

| Use Case                           | Authentication Method                                                |
| ---------------------------------- | -------------------------------------------------------------------- |
| Custom app integrations            | ✅ OAuth 2.1 (this guide)                                             |
| Automation platforms (n8n, Zapier) | ✅ OAuth 2.1 (this guide)                                             |
| API testing (Postman)              | ✅ OAuth 2.1 (this guide)                                             |
| Internal scripts and tools         | ✅ OAuth 2.1 (this guide)                                             |
| Inflection Developer API calls     | ✅ OAuth 2.1 (this guide) — or a [PAT](/api-reference/authentication) |
| Claude AI assistant                | ❌ Use MCP with DCR                                                   |
| ChatGPT integration                | ❌ Use MCP with DCR                                                   |
| Other MCP DCR compatible AI        | ❌ Use MCP with DCR                                                   |

## Prerequisites

Before you begin, ensure you have:

* Access to the Inflection Settings panel
* A redirect URL for your application (can be localhost for testing)

<AccordionGroup>
  <Accordion title="Step 1: Create a Connected App">
    1. Log in to your Inflection account
    2. Navigate to **Settings** → **Connected Apps**
    3. Click **Create App Credentials**
    4. Fill in the required fields:

    | Field           | Description                                                 | Example                                                             |
    | --------------- | ----------------------------------------------------------- | ------------------------------------------------------------------- |
    | App Name        | A descriptive name for your application                     | "My Integration App"                                                |
    | Redirect URL(s) | The URL where users will be redirected after authentication | `https://your-app.com/callback` or `http://localhost:3000/callback` |
    | Description     | Optional description of your app's purpose                  | "Integration for marketing automation"                              |

    5. Click **Connect** to create the app

    #### Important: Save Your Credentials

    After creating the app, you will receive:

    * **Client ID** - A public identifier for your app
    * **Client Secret** - A confidential key (keep this secure!)

    <Warning>
      **Store these credentials securely. The Client Secret will not be shown again.**
    </Warning>
  </Accordion>

  <Accordion title="Step 2: OAuth 2.1 Endpoints">
    Use these endpoints for authentication (you can also discover these via the [well-known endpoint](https://auth-v2.inflection.io/.well-known/oauth-authorization-server)):

    | Endpoint      | URL                                              |
    | ------------- | ------------------------------------------------ |
    | Authorization | `https://auth-v2.inflection.io/oauth2/authorize` |
    | Token         | `https://auth-v2.inflection.io/oauth2/token`     |
  </Accordion>

  <Accordion title="Step 3: Authorization Code Flow with PKCE">
    OAuth 2.1 requires PKCE for enhanced security. Here's how the flow works:

    #### 3.1 Generate PKCE Parameters

    Before starting the flow, generate these values:

    1. **Code Verifier**: A cryptographically random string (43-128 characters)
    2. **Code Challenge**: Base64-URL encoded SHA256 hash of the code verifier

    Example (JavaScript):

    ```javascript theme={null}
    // Generate code verifier
    function generateCodeVerifier() {
      const array = new Uint8Array(32);
      crypto.getRandomValues(array);
      return btoa(String.fromCharCode(...array))
        .replace(/\+/g, '-')
        .replace(/\//g, '_')
        .replace(/=/g, '');
    }

    // Generate code challenge
    async function generateCodeChallenge(verifier) {
      const encoder = new TextEncoder();
      const data = encoder.encode(verifier);
      const digest = await crypto.subtle.digest('SHA-256', data);
      return btoa(String.fromCharCode(...new Uint8Array(digest)))
        .replace(/\+/g, '-')
        .replace(/\//g, '_')
        .replace(/=/g, '');
    }
    ```

    #### 3.2 Request Authorization

    Direct the user to the authorization URL:

    ```
    https://auth-v2.inflection.io/oauth2/authorize
      ?response_type=code
      &client_id=YOUR_CLIENT_ID
      &redirect_uri=YOUR_REDIRECT_URI
      &code_challenge=YOUR_CODE_CHALLENGE
      &code_challenge_method=S256
      &scope=inflection_app
    ```

    | Parameter               | Required | Description                            |
    | ----------------------- | -------- | -------------------------------------- |
    | response\_type          | Yes      | Must be `code`                         |
    | client\_id              | Yes      | Your app's Client ID                   |
    | redirect\_uri           | Yes      | Must match the registered redirect URL |
    | code\_challenge         | Yes      | The PKCE code challenge                |
    | code\_challenge\_method | Yes      | Must be `S256`                         |
    | scope                   | Yes      | Must be `inflection_app`               |

    #### 3.3 Handle the Callback

    After the user authorizes your app, they will be redirected to your redirect URL with an authorization code:

    ```
    YOUR_REDIRECT_URI?code=AUTHORIZATION_CODE
    ```

    #### 3.4 Exchange Code for Tokens

    Make a POST request to exchange the authorization code for tokens:

    ```bash theme={null}
    curl -X POST https://auth-v2.inflection.io/oauth2/token \
      -H "Content-Type: application/x-www-form-urlencoded" \
      -d "grant_type=authorization_code" \
      -d "client_id=YOUR_CLIENT_ID" \
      -d "client_secret=YOUR_CLIENT_SECRET" \
      -d "redirect_uri=YOUR_REDIRECT_URI" \
      -d "code=AUTHORIZATION_CODE" \
      -d "code_verifier=YOUR_CODE_VERIFIER"
    ```

    #### 3.5 Token Response

    A successful response returns:

    ```json theme={null}
    {
      "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOi...",
      "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4...",
      "token_type": "Bearer",
      "expires_in": 3600
    }
    ```

    | Field          | Description                           |
    | -------------- | ------------------------------------- |
    | access\_token  | Use this to authenticate API requests |
    | refresh\_token | Use this to get new access tokens     |
    | token\_type    | Always "Bearer"                       |
    | expires\_in    | Token lifetime in seconds             |
  </Accordion>

  <Accordion title="Step 4: Using the Access Token">
    Include the access token in the Authorization header for all API requests:

    ```bash theme={null}
    curl -X POST https://campaign.inflection.io/api/v1/campaigns/campaign.list \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{"page_size": 30, "page_number": 1}'
    ```

    The same token works on the [Developer API](/api-reference/introduction), and it acts as the user who authorized the app (see [Authentication](/api-reference/authentication)):

    ```bash theme={null}
    curl https://api.inflection.io/v1/contacts/by-email/jane%40acme.com \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
    ```
  </Accordion>

  <Accordion title="Step 5: Refreshing Tokens">
    When your access token expires, use the refresh token to get a new one:

    ```bash theme={null}
    curl -X POST https://auth-v2.inflection.io/oauth2/token \
      -H "Content-Type: application/x-www-form-urlencoded" \
      -d "grant_type=refresh_token" \
      -d "client_id=YOUR_CLIENT_ID" \
      -d "client_secret=YOUR_CLIENT_SECRET" \
      -d "refresh_token=YOUR_REFRESH_TOKEN"
    ```
  </Accordion>

  <Accordion title="Integration Examples">
    <AccordionGroup>
      <Accordion title="Postman Setup">
        1. Create a new request in Postman
        2. Go to the **Authorization** tab
        3. Select **OAuth 2.0** as the type
        4. Configure with these settings:

        | Setting               | Value                                            |
        | --------------------- | ------------------------------------------------ |
        | Grant Type            | Authorization Code (With PKCE)                   |
        | Callback URL          | `https://oauth.pstmn.io/v1/browser-callback`     |
        | Auth URL              | `https://auth-v2.inflection.io/oauth2/authorize` |
        | Access Token URL      | `https://auth-v2.inflection.io/oauth2/token`     |
        | Client ID             | Your Client ID                                   |
        | Client Secret         | Your Client Secret                               |
        | Code Challenge Method | SHA256                                           |

        5. Click **Get New Access Token**
        6. Complete the login in your browser
        7. Use the token to make API requests

        **Note:** Ensure the Callback URL (`https://oauth.pstmn.io/v1/browser-callback`) is added as a Redirect URL in your Connected App settings.
      </Accordion>

      <Accordion title="n8n Setup">
        **Prerequisite:** Make sure you have created an app in inflection for n8n (shared above)

        <img src="https://mintcdn.com/inflection-4b2c0de4/N4VRWuxaoalXbMy_/images/agents/connected-apps-oauth/01.png?fit=max&auto=format&n=N4VRWuxaoalXbMy_&q=85&s=77d7023760b9bb4bd6a83e2fbfd4a525" alt="n8n HTTP request node configuration" width="1917" height="747" data-path="images/agents/connected-apps-oauth/01.png" />

        1. Use the MCP Client (If you want to use the MCP) or create and HTTP Request (If you want to use an API)

        2. Set **Authentication** to **MCP OAUTH2** or **Generic Credential Type  (OAuth2)**

                   <img src="https://mintcdn.com/inflection-4b2c0de4/N4VRWuxaoalXbMy_/images/agents/connected-apps-oauth/02.png?fit=max&auto=format&n=N4VRWuxaoalXbMy_&q=85&s=f9f6fc4457c5c35e6581a4daa40cbb82" alt="Selecting the OAuth2 authentication credential type in n8n" width="520" height="559" data-path="images/agents/connected-apps-oauth/02.png" />

        3. Configure a new OAuth2 credential:

        | Setting           | Value                                            |
        | ----------------- | ------------------------------------------------ |
        | Grant Type        | PKCE                                             |
        | Authorization URL | `https://auth-v2.inflection.io/oauth2/authorize` |
        | Access Token URL  | `https://auth-v2.inflection.io/oauth2/token`     |
        | Client ID         | Your Client ID                                   |
        | Client Secret     | Your Client Secret                               |
        | Scope             | `inflection_app`                                 |

        <img src="https://mintcdn.com/inflection-4b2c0de4/N4VRWuxaoalXbMy_/images/agents/connected-apps-oauth/03.png?fit=max&auto=format&n=N4VRWuxaoalXbMy_&q=85&s=ea234bc6abe1cbc5e6f82165eda61999" alt="n8n OAuth2 credential configuration fields" width="1046" height="726" data-path="images/agents/connected-apps-oauth/03.png" />

        4. Click **Connect** to authorize

                   <img src="https://mintcdn.com/inflection-4b2c0de4/N4VRWuxaoalXbMy_/images/agents/connected-apps-oauth/04.png?fit=max&auto=format&n=N4VRWuxaoalXbMy_&q=85&s=07612309496c7b2c1e9a1a1f18f9fc3e" alt="Connect button to authorize the n8n OAuth2 credential" width="1186" height="735" data-path="images/agents/connected-apps-oauth/04.png" />

        5. n8n will automatically handle token refresh
      </Accordion>
    </AccordionGroup>
  </Accordion>

  <Accordion title="Security Best Practices">
    1. **Never expose your Client Secret** in client-side code or public repositories
    2. **Use HTTPS** for all redirect URLs in production
    3. **Store tokens securely** - use encrypted storage or secure vaults
    4. **Implement token refresh** before expiration to ensure uninterrupted access
    5. **Use short-lived access tokens** and rely on refresh tokens for extended sessions
    6. **Validate redirect URIs** match exactly what's registered in your app
  </Accordion>
</AccordionGroup>

### Tips

* Authorization codes are valid for 5 minutes and are single-use, exchange them promptly, as reusing a code invalidates the entire session
* If using Postman, ensure the callback URL in your Connected App matches Postman's callback URL
* For local development, `http://localhost` redirect URLs are acceptable