Authentication

You can configure one (or multiple) redirect URIs in the Zapier Developer Platform under Embed → Settings → Redirect URIs

You can find your Client ID and Client Secret in the Zapier Developer Platform under Embed → Settings → Credentials

The various endpoints of the Zapier Workflow API require different OAuth scopes. Information on specific scopes required is included within the API reference for each endpoint.

Construct a URL like the one below (with your own redirect url, client id, OAuth scopes, etc.) and open a browser to that URL.

https://zapier.com/oauth/authorize
    ?response_type=code
    &client_id={YOUR_CLIENT_ID}
    &redirect_uri={YOUR_REDIRECT_URI}
    &scope={YOUR_OAUTH_SCOPES}
    &response_mode=query
    &state={RANDOM_STRING}

Here’s an explaination for each query parameter:

A full example would be:

https://zapier.com/oauth/authorize
  ?response_type=code
  &client_id=5672067294567789354752
  &redirect_uri=https%3A%2F%2Fyour-app.com%2Fcallback
  &scope=zap%20zap:write%20authentication
  &response_mode=query
  &state=tney4952

When the user visits this URL, Zapier’s authorization server will present them with a prompt asking if they would like to authorize your application’s request.

If the user approves the above request, then Zapier’s authorization server will redirect the browser back to the redirect_uri that you specified and configured earlier. Two query string parameters, code and state will also be included.

For example, the browser would be redirected to:

https://your-app.com/redirect
?code=dfJ2KuL0vKLRCwQIOL5NDGKQ&H9mlc
&state=tney4952

The final step is to exchange the authorization code that you just recieved for an access token that can be used to make authorized requests to the Zapier Workflow API. You make the exchange with a POST request to Zapier’s token endpoint https://zapier.com/oauth/token/.

Below is an example of a request that can be used to do the exchange.

Note that, in addition to client id and secret being passed as a Basic Authentication header as above, they can be passed as part of the body, using the keys client_id and client_secret.

You’ll recieve a response that looks like this:

HTTP/1.1 200 OK
Content-Type: multipart/form-data
Cache-Control: no-store
Pragma: no-cache

{
  "access_token": "jk8s9dGJK39JKD93jkd03JD",
  "expires_in": 36000,
  "token_type": "Bearer",
  "scope": "zap zap:write authentication",
  "refresh_token": "9D9oz2ZzaouT12LpvklQwNBf6s4vva"
}

The access token should be passed with requests as an Authorization header. For example:

Authorization: Bearer jk8s9dGJK39JKD93jkd03JD

All access tokens will expire after 10 hours (the number of seconds in expires_in), for security purposes. After that point, any request using that access token will return a 401 status code. To proceed, the refresh token should be exchanged for a new access token and a new refresh token. This will not require any interaction by the user.

Below is an example request that can be used:

You’ll receive a response that looks like this:

HTTP/1.1 200 OK
Content-Type: multipart/form-data
Cache-Control: no-store
Pragma: no-cache
{
  "access_token": "NEfSRKpUjVd3Nj9yyaXKs15BrM7SVA",
  "expires_in": 36000,
  "token_type": "Bearer",
  "scope": "zap zap:write authentication",
  "refresh_token": "zzdumGAW2TmayeKjzu0z9oHJiziKdn"
}

Note that you will receive a new refresh token - the old refresh token can no longer be used again, and so the new refresh token should be stored securely for future use. Refresh tokens don’t have an expiration date - they only expire when they are used to get a new access token.

You can find your client id in the Zapier Developer Platform under Embed → Settings → Credentials

From there, simply pass your client_id as a query param to any V1 endpoints that require it.

    https://api.zapier.com/v1/zap-templates?client_id={YOUR_CLIENT_ID}