---
updatedAt: 2026-07-30T22:44:04.000Z
agentTools:
  projectIndex: https://developer.maximizer.com/llms.txt
---

# Maximizer OAuth

Secure, delegated access to Maximizer data using the OAuth 2.0 Authorization Code Grant.

Maximizer OAuth lets your application access Maximizer data and services on behalf of a user, without ever handling or storing their credentials. It implements the industry-standard [OAuth 2.0](http://oauth.net/2/) Authorization Code Grant: the user signs in and grants access, and your application receives tokens to call the Maximizer APIs.

**Note:** We have examples of OAuth in the [Postman collection](https://www.postman.com/maximizercrm/maximizer-api/collection/zt4cxpy/oauth2-api).

## How It Works

```mermaid
sequenceDiagram
    actor User as Maximizer User
    participant App as Your Application
    participant MaxOAuth as Maximizer OAuth
    participant API as Maximizer API

    App->>MaxOAuth: 1. Redirect the user to the Authorize endpoint
    User->>MaxOAuth: 2. Sign in and approve access
    MaxOAuth-->>App: 3. Redirect back with an authorization code
    App->>MaxOAuth: 4. Exchange the code for tokens (POST /token)
    MaxOAuth-->>App: Access token + refresh token
    App->>API: 5. Call Maximizer APIs (Authorization: Bearer)
    API-->>App: Response
    App->>MaxOAuth: 6. Refresh the tokens when they expire (POST /token)
    MaxOAuth-->>App: New access token + refresh token
```

Each numbered interaction is described in detail in the [Authorization Code Flow](/reference/authorization-code-flow) guide.

## Prerequisites

To use Maximizer OAuth with Maximizer Cloud, you need an **OAuth `client_id` and `client_secret`**. To obtain these credentials, please send a request to **<devops@maximizer.com>** with the following information:

* **Full Name**
* **E-mail Address**
* **Organization Name**
* **Redirect URL**

You will receive the `client_id` and `client_secret` from the Maximizer team.

**Note:** Public clients (such as native or single-page applications) that cannot keep a `client_secret` confidential should use **PKCE** (Proof Key for Code Exchange) instead of a client secret. See the parameters in the [Authorization Code Flow](/reference/authorization-code-flow) guide.

## Endpoints

For Maximizer Cloud, the endpoints are the same for every account and region:

| Endpoint  | URL                                       |
| --------- | ----------------------------------------- |
| Authorize | `https://auth.maximizer.com/v1/authorize` |
| Token     | `https://auth.maximizer.com/v1/token`     |

## Guides

* [Authorization Code Flow](/reference/authorization-code-flow): step-by-step guide to obtaining and refreshing tokens. Start here.
* [Test Console](/reference/test-console): try the full flow in your browser, without writing any code.
* [OAuth for Maximizer On-Premise](/reference/oauth-on-premise): client setup and endpoint URLs for on-premise installations.
* [Migrating from the Legacy Cloud Endpoints](/reference/migrating-from-legacy-endpoints): for integrations built against the region-specific OAuth endpoints.