OAuth scopes
pages:readpages:managepublic_profileWebhooks
slambook.post.createdpage.message.received- 1
1. Create a developer app
Sign in at /developers/dashboard → Create Application. Add your OAuth redirect URI (e.g. https://yourapp.com/oauth/callback). Enable scopes pages:read and pages:manage on the app.
Development mode: only you and Test Users can OAuth until App Review approves Live mode.
- 2
2. Redirect the brand to Sign in with Aura
Send the Page admin through OAuth. They grant your app permission to manage their Pages.
GET https://aura.aisastra.com/oauth/authorize? client_id=YOUR_APP_ID &redirect_uri=https://yourapp.com/oauth/callback &scope=pages:read pages:manage public_profile &state=random_csrf_token &code_challenge=PKCE_CHALLENGE &code_challenge_method=S256
- 3
3. Exchange code for user access token (server-side)
POST to the token endpoint with client_secret — never expose the secret in browser or mobile apps.
POST https://aura.aisastra.com/api/oauth/token Content-Type: application/x-www-form-urlencoded grant_type=authorization_code &code=AUTH_CODE_FROM_CALLBACK &redirect_uri=https://yourapp.com/oauth/callback &client_id=YOUR_APP_ID &client_secret=YOUR_CLIENT_SECRET &code_verifier=PKCE_VERIFIER
- 4
4. List Pages the user manages
Use the user access token (not the app API key) for user-scoped reads.
GET https://aura.aisastra.com/api/v1/graph?node=me/pages&limit=10 Authorization: Bearer USER_ACCESS_TOKEN
- 5
5. Publish a post
POST mutation requires OAuth user token + pages:manage scope. User must own or admin the Page.
POST https://aura.aisastra.com/api/v1/graph Authorization: Bearer USER_ACCESS_TOKEN Content-Type: application/json { "node": "page/PAGE_ID/posts", "content": "Scheduled via MyApp ✨", "audience": "everyone" } - 6
6. Subscribe to webhooks
In app settings, add HTTPS webhook URL. Verify X-Aura-Signature-256 on every delivery. Subscribe to slambook.post.created for publish confirmations.
- 7
7. Submit App Review → Go Live
When ready for any brand (not just test users), submit App Review from the app console. Staff approves scopes → Live mode → aura_live_ keys and public OAuth.