OAuth 2.0

Mimasa AI supports the OAuth 2.0 authorization code flow for applications that need to act as a specific signed-in user. Your application redirects the user to Mimasa AI to approve access, Mimasa AI redirects back with an authorization code, and your backend exchanges that code for an access token and refresh token. Because the exchange happens server-side, the tokens are never exposed to the browser.

Scopes describe which resources and actions a granted token can reach — for example, read access to dashboards versus the ability to create and execute workflows. Request the narrowest set of scopes your integration actually needs; the user approving access is shown exactly which scopes are being requested. A token can never exceed the role-based permissions of the user who authorized it, even if a broader scope was requested.

Access tokens are short-lived, so long-running integrations use the accompanying refresh token to obtain a new access token without asking the user to sign in again. Refresh tokens should be stored as securely as any other credential, since possession of one lets an integration mint fresh access tokens. Revoking access from the workspace settings invalidates both the access token and its refresh token immediately.