Login and permissions
AURA uses a Meta-style permission model: scopes on user tokens, granular targets for Pages and ad accounts, and App Review for sensitive writes in Live mode.
OAuth 2.0 endpoints
| Endpoint | Purpose |
|---|---|
GET /api/oauth/authorize | Authorization code (PKCE recommended) |
POST /api/oauth/token | Exchange code or refresh token |
GET /api/oauth/debug_token | Token metadata (scopes, expiry, app id) |
Browser apps
Use @aisastra/aura-browser-sdk with PKCE. Never embed app secrets in client code.
Server apps
Use @aisastra/aura-sdk with a user token (stored securely) or app API key for server-to-server reads.
Granular scopes
Some assets require scoped grants, e.g. pages:manage/page:{pageId} — see API reference for page, ad_account, and conversation targets.
Live mode
Scopes marked requires Live in the permission table need App Review approval before production users can grant them.
See the live Permissions table at /developers/reference#permissions.