Getting Started with OAuth 2.0

What is OAuth 2.0?

Trello OAuth 2.0 is Trello's newest API authorization system. It uses slightly different mechanisms compared to our previous authorization system, but boasts extra security and flexibility.

If you've built apps before using OAuth 2.0 on other platforms, such as OAuth 2.0 3LO apps on Atlassian products, much will look familiar. The main changes that OAuth 2.0 brings are:

1. Tokens have limited lifetimes by default and must be periodically refreshed after they expire.
2. Tokens have more granular access scopes, which better reflect what resources your app wants to access.
3. The authorization and API request flow are streamlined, which offers a more consistent developer experience.

Is OAuth 2.0 right for my app?

Trello's OAuth 2.0 3LO protocol (also known as "three-legged OAuth" or "authorization code grants") is the right choice for user-facing apps, where a person logs in and consents to access. Your app can then access the Trello API on behalf of that user.

If that describes your app, then we recommend OAuth 2.0 as the most flexible and secure way for your app to access the Trello API. If your app does not run on behalf of a logged-in user (bots, automation, or server-to-server integrations), then OAuth 2.0 may not be the ideal authorization mechanism.

OAuth 2.0 Example Power-Up

We've created an OAuth 2.0 Example Power-Up for you to clone and start experimenting with OAuth 2.0 in this public repository: https://bitbucket.org/atlassianlabs/oauth-2-example-power-up/src/main/

Download the repository, and read the instructions in the README file to get the app running locally on your machine. You'll need some kind of tunneling or hosting service to host the Power-Up, such as ngrok.

Once you're done playing around with the Power-Up, be sure to take a peek into the code to see how the OAuth 2.0 authorization flow works. Looking at authorize.ts is a good place to start. Also, take a look at the OAuth 2.0 API client for Power-Ups documentation for how to use OAuth 2.0 inside Power-Ups.

Congratulations, you've just used OAuth 2.0 in Trello!

Further Reading

Be sure to checkout our other documentation to learn more about OAuth 2.0.

1. OAuth 2.0 Client Configuration - Dive deeper into the different parts of the OAuth 2.0 client configuration.
2. OAuth 2.0 API Client for Power-Ups - Read documentation on how to use OAuth 2.0 with Power-Ups.
3. OAuth 2.0 Confidential Client Usage - Learn how to create a Trello app with a confidential client.
4. OAuth 2.0 For Existing Apps - Add OAuth 2.0 to an existing app and migrate users from Trello Auth tokens.
5. Personal Data Storage and GDPR - Learn about compliance polling requirements for apps that store personal data.