1. Getting started
Astravue docs
  • Getting started
    • Introduction
    • Authentication
    • Make your first request
  • General
    • Key concepts
    • Pagination and filtering
    • Errors
    • Dates and times
  • Modules
    • Spaces and projects
    • Tasks
    • Subtasks and checklists
    • Custom fields
    • Comments
    • Time tracking
    • Bulk export
  • MCP server
    • Overview
    • Get started
    • Supported tools
    • Security
    • Build your own client
Guides
API Docs
Guides
API Docs
MCP Server
Astravue MCP on GitHub
  1. Getting started

Authentication

The Astravue API uses OAuth 2.0 with the authorization code flow. Your app signs a user in to Astravue, receives an access token, and calls the API on that user's behalf with the same permissions they have in the app.

Get an access token#

1
Create an app
In Astravue, click your profile picture and open Settings → My Apps. Click Create new app, enter an app name and the redirect URL your app will receive users on, then click Create App. You can add more redirect URLs later.
Settings in Astravue with the My Apps tab open and the Create new app button
The app page shows your Client ID and Client secret.
2
Create a PKCE code verifier
Always sign users in with PKCE: apps created now require it, and older apps accept it. For each sign-in, create a random code verifier and its S256 code challenge:
Keep the verifier on your server; you send it when you exchange the code.
3
Send the user to sign in
Redirect the user to the authorization endpoint:
https://auth.astravue.com/realms/astravue/protocol/openid-connect/auth
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REDIRECT_URL
  &scope=openid
  &state=RANDOM_STRING
  &code_challenge=CODE_CHALLENGE
  &code_challenge_method=S256
After the user signs in and approves access, Astravue redirects to your redirect_uri with a code and the state you sent.
4
Exchange the code for tokens
The response contains an access_token and a refresh_token.
5
Call the API
Send the access token as a Bearer token, together with the workspace ID, on every request:

Refresh the access token#

Access tokens are valid for 30 minutes. When one expires, request a new one with the refresh token:
The response contains a new access_token, and may contain a new refresh_token.
TokenLifetime
Access token30 minutes
Refresh tokenLong-lived; does not expire by default
WARNING
Keep your client secret on your server. Never put it in a browser app, a mobile app or a public repository.
Modified at 2026-11-10 16:20:38
Previous
Introduction
Next
Make your first request
Built with