OAuth Clients for the Public API

If you build an application that needs to act on behalf of Levitate users, you can create your own OAuth clients directly from your Levitate account — no coordination with Levitate Support required for each integration. OAuth clients let your application authenticate against the Levitate Public API using the authorization code flow with PKCE.

Note: The Public API must be enabled for your account before OAuth client management is available. Reach out to your Success Specialist or Support to enable it.

When to Use an OAuth Client

Use an OAuth client when other Levitate users will authorize your application against their own accounts. If you are only writing a script or connecting a tool to your own data, a Personal API Key is simpler — see the API Keys article.

Creating an OAuth Client

OAuth clients are managed by account Admins and Super Admins. To create one, open the dropdown menu under your name in the upper right corner, choose Integrations, and find the OAuth Clients card.

You will be asked for the following:

• Name — up to 50 characters. It cannot reference Levitate or Real Magic.
• Description — optional, up to 300 characters.
• Redirect URIs — at least one is required, and you can add up to five. Each must be a complete https:// address; plain http:// addresses are rejected.
• Scopes — the permissions the client is allowed to request. See Scopes below.

Once created, the client ID and configuration details are displayed — save these for use in your application.

Redirect URIs

A redirect URI is the address Levitate sends the user back to after they approve your application. It must match one of the URIs registered on the client exactly, so register every environment your application authorizes from — for example a staging address and a production address as two separate entries.

Only PKCE-based (Proof Key for Code Exchange) OAuth clients are supported. This is the recommended authorization flow for client applications that cannot securely store a client secret.

Scopes

A client can only be granted the scopes you select when you create it.

Select only the scopes your application actually needs.

Authorization Endpoints

Configure your application's OAuth client with the following endpoints:

• Authorization URL: https://login.levitate.ai/oauth2/authorize
• Token URL: https://login.levitate.ai/oauth2/token

Once your application has a token, send it as a Bearer token in the Authorization header of each Public API request.

Listing and Managing OAuth Clients

All OAuth clients created on your account are listed on the OAuth Clients card. From here you can view existing clients, see their configuration details, and delete clients you no longer need.

FAQs

Q: Who can create and manage OAuth clients?

A: Only users with the Admin or Super Admin role on the account can create, view, and delete OAuth clients.

Q: What authorization flow is supported?

A: Levitate supports PKCE-only OAuth clients. Client-secret flows are not supported.

Q: How is this different from a Personal API Key?

A: A Personal API Key is tied to one user and is meant for scripts and tools acting as that user. An OAuth client lets an application request access from any Levitate user, who then approves it themselves.

Q: How do I test my client without writing code?

A: The API reference at api.levitate.ai/docs includes a built-in authorization panel that runs the OAuth flow in the browser, so you can generate a token and send real requests before wiring anything up.