Build an app people connect
OAuth for an app that acts for someone, with their consent.
Send the person to /oauth/authorize with a PKCE challenge, then swap the code they come back with for tokens at /oauth/token. Only the authorization code flow with PKCE is accepted. The implicit grant is refused.
A token reaches one workspace and acts as the person who granted it, narrowed by the scopes they agreed to. They can see and disconnect apps under Settings, Profile. papertotal.com/developers has the full flow.
Related articles
Still stuck?
Write to support@papertotal.com and a person answers by email. Say what you were trying to do and what you saw, and we can start from there.