Skip to main content
Getting started with authentication is a 3-step process:
  1. Set up your redirect URL.
  2. Acquire credentials from CRO.
  3. Verify credentials work.
The CRO API uses OAuth 2.0. It supports Authorization Code and Refresh Token grants and the Authorization Code and PKCE flows. At this time the Client Credentials grant (use of passwords) is not supported and will not be supported in the future.

​
Redirect URL

The redirect URL (also called a callback URL) is the OAuth 2.0 endpoint in your application that we send the user’s browser back to after they sign in. It arrives carrying the authorization code that your app exchanges for tokens — so it must be a route your code actually handles, not a general web page. A company homepage or marketing page will not work: nothing there can receive or process the authorization code, and the sign-in flow will dead-end. Typical values:
  • A route in your app, e.g. https://yourapp.example.com/oauth/callback
  • http://localhost:3000/oauth/callback during development
  • The fixed callback URL published by the platform or OAuth library you’re building on (e.g. Google Apps Script’s https://script.google.com/macros/d/{SCRIPT_ID}/usercallback, Postman’s https://oauth.pstmn.io/v1/callback)
You must provide this URL before we issue credentials, because we register it on your OAuth client — the flow only redirects to exactly-matching registered URLs. It can be changed any time after provisioning, and we can register more than one (e.g. development + production).

​
Acquire Credentials from CRO

Once you have a redirect URL, contact our development team at crodev@rapidworks.com to have your credentials issued. Please keep the subject line as “CRO API Credentials Request” so we can route it quickly. See the FAQ for what to include in your request to avoid a round trip.

​
Verify Credentials Work

With your account provisioned, now you’re ready to make everything work. The easiest way to get started is to use an app like Postman. Postman has built in support for OAuth testing, but any HTTP client tool should work.

​
Request Access Token

Assuming you’re using Postman, create a new request and click on the “Authentication” tab. Step 1: click on "Authorization" tab. Then click on “Request New Access Token”. Step 2: click on "Request New Access Token". Now fill out the dialog with the credentials and URLs given to you by the CRO development team. The “State” field must be at least 8 characters and may be whatever text you choose. Step 3: Fill out request dialog. Click “Request Token” and you will be redirected to a login page. Login page Upon successful login, you will be presented with your new access token. New access token This token may now be used for accessing the CRO API. Include it as an Authorization bearer header with requests requiring it (most).

​
Conclusion

Congrats! Now you’ve got access to the CRO API. If you are still struggling with these steps, reach out to us