Third-Party App Authentication

This section explains how to let FYERS clients log in to your platform with their own credentials. Third-party apps are created by platform providers so that FYERS clients can use their applications.

To create a common app, you can get in touch with us at [email protected].

Third-party apps use the OAuth 2.0 authorization code flow. Send the user to the FYERS login page, receive an auth_code at your redirect_uri, then exchange it from your backend server for an access_token. The flow is not recommended for single-page applications.

redirect_uri must be the same URL provided at app creation. Keep it under your control, because the auth token is sensitive.
appIdHash is the SHA-256 hash of app_id:app_secret. You can use this online tool for reference.
Access tokens expire daily at 6:30 AM. Generate a new token after 6:30 AM for it to remain valid throughout the day.
Send app_id:access_token in the HTTP Authorization header on every request after login. See API Standards.
Never store the app_secret in front-end code. See the Best Practices.

Endpoint	Method	Description
OAuth 2.0 Flow	—	This guide explains how your platform logs in FYERS users and gets an access token for each of them.
User Authorization	GET	This API allows you to send a user to the FYERS login page to authorize your app.
Authorization Code	—	This page describes the auth_code and state that FYERS sends to your redirect_uri after the user logs in.
Generate Access Token	POST	This API allows you to exchange an auth code for the access token of a user.
Best Practices	—	This guide lists the practices that keep your app credentials and users' tokens secure.