COUNTCOUNT
Sign Up

Getting Started

OAuth Consent Experience

What your users see when they connect COUNT to your app — and what you need to implement on the redirect back to your product.

Build trust with a clear UX

Partners who show a polished connect flow convert better. Match COUNT's consent language in your app and explain why you need access before redirecting users.

What the user sees

After you initiate OAuth, the user signs in to COUNT (if needed) and lands on a consent screen showing your app name and the workspace being connected. They choose Allow access or Cancel.

C

COUNT Partner Sign-in

Connect to Your App

Your App is requesting access to your COUNT workspace Acme Books.

This app will be able to

  • Read and write accounting data in this workspace
  • Access customers, invoices, transactions, and related records
  • Act on your behalf until you disconnect the app

Mock consent screen for documentation — not interactive.

Workspace vs firm OAuth routes

Workspace partner apps start at GET /auth2/authorize-intiate (legacy spelling — this is the live route). Firm or practice OAuth uses GET /auth2/firm/authorize-initiate instead. See API access credentials for a route summary.

Before redirecting

  1. Register your exact redirect URI in COUNT Partners — must match character-for-character including trailing slashes.
  2. Generate a cryptographically random state value and store it server-side.
  3. Call GET /auth2/authorize-intiate with your clientId, redirectUri, and state.
  4. Redirect the user to the consent URL returned by the initiate endpoint.

After the user approves

COUNT redirects to your registered URI with an authorization code and the same state you sent:

Successful redirect
https://your-app.com/oauth/callback?code=AUTH_CODE&state=YOUR_STATE

Exchange the code at POST /partners/grant-access-token (signed with HMAC, no Bearer token). Store the access and refresh tokens securely server-side.

Branding guidelines

  • Use Connect to COUNT or Sign in with COUNT for your button label.
  • Refer to the product as COUNT (all caps) in user-facing copy.
  • Explain which workspace data your app will access before the user leaves your site.
  • Provide a disconnect or revoke path in your app settings after connection.

Error and edge cases

Handle these cases
// User denied consent — no code is returned; handle missing code gracefully.
// Invalid or expired state — reject the callback (possible CSRF).
// User closed the window — your app should offer "Connect to COUNT" again.

See Errors & troubleshooting for HTTP error codes during token exchange.

Related