Sign In With Roboflow (Getting Started)

You can build applications that authenticate users with their Roboflow account using the OAuth 2.1 authorization code flow with PKCE. This lets your app act on behalf of a Roboflow user, scoped to only the permissions they approve.

OAuth access tokens work on api.roboflow.com with Authorization: Bearer. See Authenticate with the REST API for details.

For endpoint tables, visibility, errors, and a runnable sample app, see Sign In With Roboflow (Developer Reference).

Create an OAuth App

To register your application:

1

Open Developer Settings

Go to Workspace Settings > Developer in your Roboflow dashboard at app.roboflow.com.

2

Create a new OAuth app

Click Create OAuth App (or New app) and fill in:

Field

Description

Name

Display name on the consent screen and in your OAuth apps list

Homepage URL

Your product URL (shown on consent; informational)

Redirect URIs

One or more callback URLs (must match your code exactly)

Token endpoint authentication

How the client sends its secret to the token endpoint: client_secret_post (secret in the request body, default) or client_secret_basic (secret in the HTTP Basic Authorization header). Most MCP gateways (Azure, TrueFoundry) use client_secret_basic.

Allowed scopes

Every scope you will request at sign-in

Visibility

Internal, Unlisted, or Public - see Developer Reference - Visibility

You will receive a Client ID and Client Secret (rfcs_…). The secret is shown only once, so store it securely on your server.

Redirect URI examples

HTTPS is required for public hosts. HTTP is allowed only for loopback (localhost, 127.0.0.1, ::1).

Authorization Flow

Roboflow uses the authorization code grant with PKCE (Proof Key for Code Exchange). PKCE is required for all clients.

1

Generate a PKCE code verifier and challenge

Create a random code_verifier (43–128 characters) and derive a code_challenge from it using SHA-256:

Copy

import hashlib, base64, secrets

code_verifier = secrets.token_urlsafe(32)
code_challenge = base64.urlsafe_b64encode(
    hashlib.sha256(code_verifier.encode()).digest()
).rstrip(b"=").decode()

2

Redirect the user to authorize

Send the user to the Roboflow authorization endpoint:

Copy

https://app.roboflow.com/oauth/authorize?
  client_id=YOUR_CLIENT_ID&
  redirect_uri=https://yourapp.com/callback&
  response_type=code&
  scope=openid profile email workspace:read&
  code_challenge=YOUR_CODE_CHALLENGE&
  code_challenge_method=S256&
  state=YOUR_STATE_VALUE

Use a cryptographically random state and verify it on callback. Store code_verifier server-side until you exchange the code.

The user sees a consent screen with the permissions your app requested.

After they approve, Roboflow redirects to your redirect_uri with code and state.

3

Exchange the code for tokens

On your server (never in the browser), POST to the token endpoint:

Copy

curl -X POST https://app.roboflow.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "code=AUTHORIZATION_CODE" \
  -d "redirect_uri=https://yourapp.com/callback" \
  -d "code_verifier=YOUR_CODE_VERIFIER"

The response includes:

• access_token — call Roboflow APIs (valid for 1 hour, or 24 hours for MCP clients)

• refresh_token — get new access tokens (valid for 30 days)

• id_token — JWT with identity claims (when openid is requested)

Using OAuth Tokens

Once you have an access token, send it in the Authorization header:

Validate a Token

If you hold an opaque rfoa_ access token and need to check its status or expiry without client credentials, call the validate endpoint:

Response (always HTTP 200):

workspace_id and user_id identify the workspace and user the token is bound to, so callers can attribute requests without a separate lookup. Both are null when the token is inactive.

An expired or revoked token returns { "active": false, "exp": null, ... } instead of an HTTP error, so callers can distinguish a dead token from an unreachable auth server.

Refresh a Token

Access tokens expire after 1 hour (24 hours for MCP clients). Use the refresh token to get a new one:

Revoke a Token

To revoke an access or refresh token:

User Info

Retrieve profile information for the authenticated user (requires openid):

Available Scopes

Your app can request any combination of the following scopes. Each scope must also be enabled on your OAuth app's Allowed scopes list.

Identity Scopes

API Scopes

OIDC Discovery

Roboflow publishes standard OpenID Connect discovery documents:

• OpenID Configuration: https://app.roboflow.com/.well-known/openid-configuration

• JWKS (for verifying ID tokens): https://app.roboflow.com/.well-known/jwks.json

Next steps

• Sign In With Roboflow (Developer Reference) — hosts, visibility, errors, example app

• Authenticate with the REST API