Developers & API

Use HAWI OAuth authorization code flow

Register an exact redirect URL, use state and PKCE where applicable, exchange the one-time code, then rotate refresh tokens.

HAWI OAuth authorization codes are short-lived, one-time, client-bound and redirect-URI-bound. Production redirects require HTTPS and exact matching. Access tokens are short-lived and bound to the app, installation, environment, account, workspace and scopes. Uninstalling or revoking the installation removes future access.

Audience: developer
Updated: 2026-08-24

Create a HAWI developer appEnroll as a developer, create or join a developer organization, then create an app owned by that organization.
Verify a HAWI webhookVerify the signature over the unmodified body and timestamp, enforce the replay window and deduplicate the event ID.
API errors, request IDs and rate limitsUse the structured error and request ID; respect per-app, account and endpoint rate limits.

Use HAWI OAuth authorization code flow

Related guides