# Oauth Problems

**URL:** <https://community.smartthings.com/t/oauth-problems/300185>\
**Category:** Support\
**Created:** [May 12, 2025, 10:51am UTC](https://community.smartthings.com/t/oauth-problems/300185 "2025-05-12T10:51:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Schmuckerl](https://avatars.discourse-cdn.com/v4/letter/s/b5e925/32.png) [@Schmuckerl](https://community.smartthings.com/u/Schmuckerl)\
**Post date:** [May 12, 2025, 10:51am UTC](https://community.smartthings.com/t/oauth-problems/300185/1 "2025-05-12T10:51:50Z")

</div>

Hi,  
trying to authorize with Oauth2 but always get 403 Forbidden

What I did:

- Created SmartApp with Hosting Type Webhook
- My redirect URL is a php script
- Status is Deployed to test

curl -v [SmartThings. Add a little smartness to your things.](https://account.smartthings.com/oauth/authorize) -d “response\_type=code&client\_id=xxx&redirect\_uri=[https://myurl/callback.php&scope=r:devices:](https://myurl/callback.php&scope=r:devices:)\* w:devices:\* x:devices:\*”

I get 403 and the redirect URL has not been visited.

Whats wrong?

Thanks, Werner

---

<div class="post-metadata">

**Author:** ![Schmuckerl](https://avatars.discourse-cdn.com/v4/letter/s/b5e925/32.png) [@Schmuckerl](https://community.smartthings.com/u/Schmuckerl)\
**Post date:** [May 12, 2025, 11:24am UTC](https://community.smartthings.com/t/oauth-problems/300185/2 "2025-05-12T11:24:57Z")

</div>

when trying:

curl -v “https//account.smartthings.com/oauth/authorize&response\_type=code&client\_id=xxx&redirect\_uri=[https://myurl/callback.php&scope=r:devices:](https://myurl/callback.php&scope=r:devices:)\*” -u “client:secret”

I get 307 Temporary Redirect but my callback URL still not visited

---

<div class="post-metadata">

**Author:** ![orangebucket](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/orangebucket/32/81590_2.png) [@orangebucket](https://community.smartthings.com/u/orangebucket)\
**Post date:** [May 12, 2025, 1:35pm UTC](https://community.smartthings.com/t/oauth-problems/300185/3 "2025-05-12T13:35:38Z")

</div>

> [@Schmuckerl](#):
>
> - Created SmartApp with Hosting Type Webhook
> - My redirect URL is a php script
> - Status is Deployed to test

OK so that sounds like a [Webhook SmartApp](https://developer.smartthings.com/docs/connected-services/smartapp-basics) and as it is deployed to test it should be visible in the mobile app under _Discover_ on the _Routines_ page. That’s the same place where templated routines and Smart Lighting (if available) appear.

You would then create an instance of that app by clicking on it and you app would be taken though the CONFIGURATION lifecycle and so on as documented.

> [@Schmuckerl](#):
>
> curl -v [SmartThings. Add a little smartness to your things.](https://account.smartthings.com/oauth/authorize) -d “response\_type=code&client\_id=xxx&redirect\_uri=[https://myurl/callback.php&scope=r:devices:](https://myurl/callback.php&scope=r:devices:)\* w:devices:\* x:devices:\*”

That, on the other hand, is something you would do with an [OAuth Integration](https://developer.smartthings.com/docs/connected-services/oauth-integrations), also known as API\_ONLY or ‘API Access’.