Kaminari Ad

OAuth 2.0 & connected apps

Authorize third-party apps and AI agents to act on behalf of a user with scoped, revocable access tokens.

When a third-party app or AI agent needs to act on behalf of a Kaminari Ad user, it uses OAuth 2.0 rather than a shared API key.

What we support

Kaminari Ad implements the standard Authorization Server surface:

  • Authorization Code + PKCE — the secure flow for public clients.
  • Refresh tokens — long-lived access without re-prompting.
  • Dynamic Client Registration — apps register themselves.
  • Token revocation and discovery metadata.

The flow

  1. The app registers (or is pre-registered) as a client.
  2. It redirects the user to the authorize endpoint with the scopes it needs.
  3. The user reviews and approves on the consent screen.
  4. The app exchanges the code (with its PKCE verifier) for an access token and refresh token.
  5. It calls the API with the access token as a Bearer token.

Managing access

Users see every app they have authorized under Account -> Connected apps and can revoke any of them. Access tokens carry only the scopes the user approved, and revocation is immediate.

This is the same mechanism that powers agent access via the MCP server.

← All documentation