Registration
You must be an Administrator of an Optimizely account to register an application. Registering an application requires the following inputs:
- An application name that identifies your application to Optimizely Web Experimentation customers.
- One or more redirect URIs that users are redirected to after authorizing access to your application.
- A client type (either public or confidential) according to the grant type you wish to use in your application.
Upon registering an application, you receive a client ID that uniquely identifies your application and is required in the authorization flow described below. You also receive a client secret, which is required for an authorization code exchange.
Authorization
To enable users to authorize your application, you must link to Optimizely's authorization endpoint on app.optimizely.com using the client ID and a redirect URI provided during registration. For example, the Example URL below sends the user to an authorization flow for client ID 123 with a redirect to http://myapplication.com. See Definitions below for a full list of required parameters in the authorization endpoint.
We recommend you use the Connect with Optimizely button below, which you may resize as needed:
After clicking this link, users are prompted to log in to Optimizely. They are then given the option to accept or deny authorization for your application. Users can revoke your application's access to their data at any time in their API Access settings.
Definitions
- client_id – The client ID for your application (see app settings).
- redirect_uri – A URL-encoded redirect URI to which the user is redirected after successful (or failed) authorization. This must match one of the URIs provided during registration. If you're using an authorization code grant, insecure URLs such as those starting with http:// are rejected. You can always add more redirect URIs to your application on the registration page.
- response_type – The grant type your application requests for authorization. The supported types are token (for implicit grant) and code (for authorization code grant).
- scopes – A string denoting the access scopes your application requires after authorization. The only supported value is all, meaning the generated token has permissions that match the user role of the authorizing user.
- state – Value you provide that is relayed back to you in the response to protect against CSRF attacks. For more information, see the CSRF section of the OAuth 2.0 spec.
- (Optional) account_id – Specify the account ID you want to authorize against.
Example URL
https://app.optimizely.com/oauth2/authorize
?client_id=123
&redirect_uri=http%3A%2F%2Fmyapplication.com
&response_type=token
&scopes=all
&state=somesecurestate
&account_id=123456