OAuth Applications
Use OAuth Applications to let external apps securely connect to your Rivo data through the Developer API.
With OAuth, you can control where an app is allowed to send users during sign-in, whether the app is a confidential or public client, and which app credentials it should use.
Before you start
Make sure you can access Settings → Developer Toolkit in your Rivo dashboard.
Decide which app or service you want to connect.
Collect the redirect URL(s) from that app before setup.
Create an OAuth application
Open OAuth Applications in your Rivo admin.
Click New Application.
Complete the form:
Name: A label to identify the app.
Redirect URI(s): Add one callback URL per line.
Icon (optional): Upload an image. Recommended size is 42 x 42 px.
Confidential: Keep enabled for server-side apps that can securely store secrets. Disable for public clients (for example, mobile or browser-based apps).
Click save to create the application.
Save your client secret immediately
After creating an application, Rivo shows the client secret once.
Copy and store it in your secure password manager or secrets manager before leaving the page.
If you leave this screen without saving it, the secret cannot be retrieved.
Credentials and permissions
Each OAuth application includes:
Client ID
Client Secret
Redirect URI(s)
Confidential setting
The OAuth Applications flow currently uses the Developer API scope, which grants access to loyalty data such as customers, points, rewards, referrals, VIP tiers, and memberships.
Test the authorization flow
Once at least one redirect URI is set, the application details page shows Authorize test links.
Open the application details page.
Click Authorize next to the redirect URI you want to test.
Review the permission prompt.
Click Authorize to continue or Deny to cancel.
If you manage multiple stores, confirm you are approving the correct store during authorization.
Manage existing applications
From the OAuth Applications list, you can:
Open an application to view credentials and configuration.
Edit the Name, Redirect URI(s), Icon, or Confidential setting.
Delete an application you no longer use.
Deleting an application is permanent and cannot be undone.
Troubleshooting
Redirect URI validation errors
If your redirect URI is rejected, confirm that each URI:
Is a complete absolute URL
Uses
https://Does not include URL fragments (for example,
#section)
I can’t see my client secret anymore
The client secret is only shown once at creation time. If it was not saved, create a new application and update your integration with the new credentials.
Authorization isn’t returning to my app
Double-check that the redirect URI in your app exactly matches one of the redirect URIs saved in Rivo.
FAQ
Can I use multiple redirect URLs in one application?
Yes. Add one redirect URI per line in the application settings.
Can I upload an icon for each OAuth app?
Yes. Icons are optional and can be added or removed from the application form.
Can I change an app after creating it?
Yes. You can edit application details at any time.
Can I recover a deleted application?
No. Deletion is permanent. You would need to create a new application.