Automation OAuth (PKCE)

Third-party apps (Zapier, Make, n8n) use authorization code + PKCE against the Automation OAuth endpoints.

Endpoints

Authorize (summary)

Query parameters:

• client_id - platform-specific Automation client id (Zapier / Make / n8n)
• redirect_uri - must match an allowed redirect for that client
• response_type=code
• code_challenge + code_challenge_method=S256 (PKCE)
• state - CSRF protection

If the browser has no active session, the API redirects to the hosted connect experience before returning the authorization code.

Token exchange

POST /api/automation/oauth/token with JSON body:

{
  "grant_type": "authorization_code",
  "code": "...",
  "code_verifier": "...",
  "client_id": "zapier_automation_client",
  "redirect_uri": "https://zapier.com/dashboard/auth/oauth/return/AppID/"
}

Response includes access_token, refresh_token, expires_in, token_type: "Bearer". Refresh with grant_type=refresh_token and the same client_id.

After you have access_token

Use it exactly like an Automation connection key on /automation/webhooks/*, /api/automation/actions/*, and /automation/connections.

Further reading

• Automation overview
• Automation triggers
• Integrations hub