Maximizer OAuth

Maximizer OAuth lets your application access Maximizer data and services on behalf of a user, without ever handling or storing their credentials. It implements the industry-standard OAuth 2.0 Authorization Code Grant: the user signs in and grants access, and your application receives tokens to call the Maximizer APIs.

Note: We have examples of OAuth in the Postman collection.

How It Works

sequenceDiagram
    actor User as Maximizer User
    participant App as Your Application
    participant MaxOAuth as Maximizer OAuth
    participant API as Maximizer API

    App->>MaxOAuth: 1. Redirect the user to the Authorize endpoint
    User->>MaxOAuth: 2. Sign in and approve access
    MaxOAuth-->>App: 3. Redirect back with an authorization code
    App->>MaxOAuth: 4. Exchange the code for tokens (POST /token)
    MaxOAuth-->>App: Access token + refresh token
    App->>API: 5. Call Maximizer APIs (Authorization: Bearer)
    API-->>App: Response
    App->>MaxOAuth: 6. Refresh the tokens when they expire (POST /token)
    MaxOAuth-->>App: New access token + refresh token

Each numbered interaction is described in detail in the Authorization Code Flow guide.

Prerequisites

To use Maximizer OAuth with Maximizer Cloud, you need an OAuth client_id and client_secret. To obtain these credentials, please send a request to [email protected] with the following information:

• Full Name
• E-mail Address
• Organization Name
• Redirect URL

You will receive the client_id and client_secret from the Maximizer team.

Note: Public clients (such as native or single-page applications) that cannot keep a client_secret confidential should use PKCE (Proof Key for Code Exchange) instead of a client secret. See the parameters in the Authorization Code Flow guide.

Endpoints

For Maximizer Cloud, the endpoints are the same for every account and region:

Guides

• Authorization Code Flow: step-by-step guide to obtaining and refreshing tokens. Start here.
• Test Console: try the full flow in your browser, without writing any code.
• OAuth for Maximizer On-Premise: client setup and endpoint URLs for on-premise installations.
• Migrating from the Legacy Cloud Endpoints: for integrations built against the region-specific OAuth endpoints.