Documentation

1. Register an OAuth app

Add the exact redirect URI and copy your Client ID. Confidential apps receive a Client Secret once.

2. Authorize

GET /oauth/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=https%3A%2F%2Fexample.com%2Fcallback&response_type=code&scope=profile&state=RANDOM_VALUE

Public apps must also send code_challenge and code_challenge_method=S256.

3. Exchange the code

POST /oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET
&code=AUTHORIZATION_CODE
&redirect_uri=https%3A%2F%2Fexample.com%2Fcallback
&code_verifier=PKCE_VERIFIER

Codes expire in five minutes and are single-use.

4. Tokens

OAuth access tokens use mnv_oauth_.... Manual API tokens remain mnv_live_.... They are separate credential systems.

5. Refresh

Use grant_type=refresh_token. Minivo rotates refresh tokens, so an old refresh token cannot be reused after rotation.

Scopes