Skip to content
Yareta

OAuth 2.0 for partner apps

Use this when your application needs to call Yareta as a signed-in user (the same pattern the Yareta app uses).

Yareta implements the authorization code grant (RFC 6749) plus refresh (and revoke).

Registering a client

There is no public self-service developer portal. Email connect@yareta.co with:

  • Application name
  • Redirect URIs (exact match, including https and path)
  • Requested scopes: basic, profile, and/or all (default all basic profile)

You receive client_id and client_secret (secret shown once). Store the secret on a server.

Authorize

GET https://platform.yareta.ai/api/oauth/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https://your-app.com/callback
  &scope=all%20basic%20profile

Optional: prompt=login to force the login screen.

The user signs in to Yareta (investor login) and consents. Yareta redirects to:

https://your-app.com/callback?code=AUTHORIZATION_CODE

Redirect URI must exactly match a registered URI (no wildcards).

Authorization codes expire quickly (minutes) and are single use.

Token exchange (server-side)

POST https://platform.yareta.ai/api/oauth/token
Content-Type: application/json

{
  "grant_type": "authorization_code",
  "code": "AUTHORIZATION_CODE",
  "redirect_uri": "https://your-app.com/callback",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET"
}

Response:

{
  "access_token": "<jwt>",
  "refresh_token": "<opaque>",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "all basic profile"
}

Refresh:

{
  "grant_type": "refresh_token",
  "refresh_token": "<opaque>",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET"
}

Refresh tokens rotate. A short grace window allows in-flight retries with the previous token.

Revoke: POST /api/oauth/revoke with token value, client credentials, optional token_type_hint.

Using the access token

POST /api HTTP/1.1
Host: platform.yareta.ai
Authorization: Bearer ACCESS_TOKEN
Content-Type: application/json


{ "query": "{ getUserDataQuery { email } }" }

See Partner GraphQL for the operations you are licensed to call.

Security checklist

  • HTTPS everywhere
  • Token exchange only on a server
  • Store tokens in HTTP-only cookies or encrypted server storage — not localStorage if you can avoid it
  • Revoke on logout
  • Encrypt tokens at rest