# OAuth2

The Bare Bitcoin API has (limited) support for OAuth2, allowing
users to grant 3rd party applications access to their account, without having to set up API keys.

## Registering your application

Before integrating the Bare Bitcoin API using OAuth2, you need to register
your application by setting up an OAuth2 client. This is currently a manual
process. Reach out to hei@barebitcoin.no if this is of interest to you!

## URLs

* **Authorize URL**: `https://barebitcoin.no/rest/oauth2/v0/authorize`
* **Token URL**: `https://barebitcoin.no/rest/oauth2/v0/token`
* **Verify URL**: `https://barebitcoin.no/rest/oauth2/v0/verify`


## Scopes

We currently support three scopes:

- `api:accounts:bitcoin:read` lets you read the user's bitcoin accounts:
their names and balances. No transaction data!
- `api:trades:read` lets you read the user's completed trades (buys and
sells).
- `api:tax:transactions:read` lets you read the transactions that are
relevant for tax reporting. This is the scope used by tax services such
as Kryptosekken.


When requesting authorization, pass the scopes you need as a
space-separated list in the `scope` parameter. You must request at least
one scope, and listing the same scope twice is rejected. The user is shown
a consent screen with a description of each scope you requested.

A user can have one active consent per client. If you later request a
different set of scopes, the existing consent is replaced and all access
tokens issued under it are invalidated, so the user has to go through the
authorization flow again.