OAuth Apps

If you’re building a tool that other SEObox customers will connect to — rather than a script for your own account — use OAuth instead of asking users for their API key.

Register your app

Go to Settings → API → Connected apps (OAuth) and register your app with its redirect URI. You get a client ID (nsc_…) and a client secret (nss_…). The secret is shown once.

Authorization flow

Send the user to the consent page:


https://app.seobox.tech/oauth/consent?client_id=nsc_…&redirect_uri=https%3A%2F%2Fyourapp.com%2Fcallback&state=<random>

redirect_uri must exactly match one you registered. scope is optional.

When the user approves, SEObox redirects them to your redirect_uri with code and your state. Check that state matches. The code is valid for 10 minutes.

Exchange the code for a token:


curl -X POST https://api.seobox.tech/v1/public/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "<code>",
    "client_id": "nsc_…",
    "client_secret": "nss_…",
    "redirect_uri": "https://yourapp.com/callback"
  }'


{ "access_token": "eyJ…", "token_type": "Bearer", "scope": "read write", "expires_in": 31536000 }

Call the API with the token. Send it in the x-api-key header, the same way as an API key, not in Authorization:
```
curl https://api.seobox.tech/v1/api/sites -H "x-api-key: <access_token>"
```

Tokens last 365 days. When one expires, send the user through the flow again.