---
title: "OAuth Consent Experience · COUNT Partner API"
description: "What your users see when they connect COUNT to your app, and what you need to implement on the redirect back to your product."
canonical: "https://developers.getcount.com/getting-started/oauth-consent"
source: "https://developers.getcount.com/getting-started/oauth-consent"
---
Getting Started

# OAuth Consent Experience

What your users see when they connect COUNT to your app — and what you need to implement on the redirect back to your product.

Build trust with a clear UX

Partners who show a polished connect flow convert better. Match COUNT's consent language in your app and explain why you need access before redirecting users.

## What the user sees

After you initiate OAuth, the user signs in to COUNT (if needed) and lands on a consent screen showing your app name and the workspace being connected. They choose **Allow access** or **Cancel**.

C

COUNT Partner Sign-in

### Connect to Your App

Your App is requesting access to your COUNT workspace **Acme Books**.

This app will be able to

- Read and write accounting data in this workspace
- Access customers, invoices, transactions, and related records
- Act on your behalf until you disconnect the app

Mock consent screen for documentation — not interactive.

Workspace vs firm OAuth routes

Workspace partner apps start at `GET /auth2/authorize-intiate` (legacy spelling — this is the live route). Firm or practice OAuth uses `GET /auth2/firm/authorize-initiate` instead. See [API access credentials](https://developers.getcount.com/getting-started/credentials) for a route summary.

## Before redirecting

1. Register your exact redirect URI in [COUNT Partners](https://app.getcount.com/count-partners) — must match character-for-character including trailing slashes.
2. Generate a cryptographically random `state` value and store it server-side.
3. Call `GET /auth2/authorize-intiate` with your `clientId`, `redirectUri`, and `state`.
4. Redirect the user to the consent URL returned by the initiate endpoint.

## After the user approves

COUNT redirects to your registered URI with an authorization code and the same `state` you sent:

Successful redirect

```bash
https://your-app.com/oauth/callback?code=AUTH_CODE&state=YOUR_STATE
```

Exchange the code at `POST /partners/grant-access-token` (signed with HMAC, no Bearer token). Store the access and refresh tokens securely server-side.

## Branding guidelines

- Use **Connect to COUNT** or **Sign in with COUNT** for your button label.
- Refer to the product as **COUNT** (all caps) in user-facing copy.
- Explain which workspace data your app will access before the user leaves your site.
- Provide a disconnect or revoke path in your app settings after connection.

## Error and edge cases

Handle these cases

```javascript
// User denied consent — no code is returned; handle missing code gracefully.
// Invalid or expired state — reject the callback (possible CSRF).
// User closed the window — your app should offer "Connect to COUNT" again.
```

See [Errors & troubleshooting](https://developers.getcount.com/getting-started/errors) for HTTP error codes during token exchange.

## Related

- [Authentication & signing](https://developers.getcount.com/getting-started/authentication)
- [Refresh an access token](https://developers.getcount.com/guides/refresh-access-token)
- [Partner Program](https://developers.getcount.com/resources/partner-program)