API keys are right for server-to-server access you control. OAuth is right when a user grants your app access to their workspace, so you act on their behalf without holding their credentials.
Run the OAuth flow
- Register your app. Create an app in Settings → Developers and note your client ID and secret.
- Redirect to authorise. Send the user to the authorisation URL with your client ID and redirect URI.
- Exchange the code. After the user approves, exchange the returned code for an access token.
- Call the API. Use the access token as a bearer token, and refresh it when it expires.
