# OAuth2 callback for SmartApp **URL:** \ **Category:** Writing SmartApps\ **Created:** [August 5, 2014, 6:25am UTC](https://community.smartthings.com/t/oauth2-callback-for-smartapp/3917 "2014-08-05T06:25:53Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![florianz](https://avatars.discourse-cdn.com/v4/letter/f/eada6e/32.png) [@florianz](https://community.smartthings.com/u/florianz)\ **Post date:** [August 5, 2014, 6:25am UTC](https://community.smartthings.com/t/oauth2-callback-for-smartapp/3917/1 "2014-08-05T06:25:53Z")
I need some pointers w.r.t. defining an OAuth2 callback in a SmartApp in order to connect to a web service: Assuming the service uses Google OAuth2, the response callback [can’t be dynamic](https://developers.google.com/accounts/docs/OAuth2WebServer#handlingtheresponse). As for most authentication providers, the redirect URI must be known beforehand, so using an endpoint URL won’t work (it has the SmartApp installation id in the path). Does SmartThings provide some sort of static callback that SmartApps can use to dispatch responses back to the dynamic endpoint? Thanks! ---
**Author:** ![schettj](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/schettj/32/12194_2.png) [@schettj](https://community.smartthings.com/u/schettj)\ **Post date:** [August 12, 2014, 7:24pm UTC](https://community.smartthings.com/t/oauth2-callback-for-smartapp/3917/2 "2014-08-12T19:24:19Z")
That’s not how oath works. Your service should handle the callback, so it should point to your service web presence, where your client code receives the callback, saves the data, uses it to get the access token, etc. There are many implementations of oauth clients out there, see [http://oauth.net/2/](http://oauth.net/2/) under client libraries ---
**Author:** ![florianz](https://avatars.discourse-cdn.com/v4/letter/f/eada6e/32.png) [@florianz](https://community.smartthings.com/u/florianz)\ **Post date:** [August 14, 2014, 12:15am UTC](https://community.smartthings.com/t/oauth2-callback-for-smartapp/3917/3 "2014-08-14T00:15:42Z")
I should have made clear that this is for a SmartApp to authenticate with a service not the other way around. So, yes, I still need the app to provide some sort of authentication callback. ---
**Author:** ![pstuart](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/pstuart/32/82936_2.png) [@pstuart](https://community.smartthings.com/u/pstuart)\ **Post date:** [August 18, 2014, 2:57am UTC](https://community.smartthings.com/t/oauth2-callback-for-smartapp/3917/4 "2014-08-18T02:57:28Z")
Take a look at the ecobee (connect) smartapp. It implements the OAUTH2 methods correctly using a round trip OATUH endpoint. Very cool. ---
**Author:** ![florianz](https://avatars.discourse-cdn.com/v4/letter/f/eada6e/32.png) [@florianz](https://community.smartthings.com/u/florianz)\ **Post date:** [August 19, 2014, 12:10am UTC](https://community.smartthings.com/t/oauth2-callback-for-smartapp/3917/5 "2014-08-19T00:10:42Z")
Thanks @pstuart. Unfortunately, the ‘Ecobee (Connect)’ app also uses a dynamic redirect URI for the authentication callback. Most OAuth2 authentication providers do not support that pattern anymore. The redirect URI must be constant and known ahead of time. I needs to be specified when registering the client id. Specifically, ecobee uses this URI to redirect the callback: `/api/token/${atomicState.accessToken}/smartapps/installations/${app.id}/swapToken`. With that URI, at least the app installation id is dynamic, and cannot be known ahead of time. I think the only way this could work is if SmartThings were to provide a constant callback URI. Most providers DO allow for passing some sort of state token through the redirect URI, and SmartThings could use this state for the constant callback to dispatch / redirect to the dynamic, app installation dependent callback: So, `/api/token/constantCallback?state=${app.id}` (provided by SmartThings) could redirect to `/api/token/.../smartapps/installations/${app.id}/dynamicCallback` (implemented as app endpoint). Does that make sense? ---
**Author:** ![sami](https://avatars.discourse-cdn.com/v4/letter/s/35a633/32.png) [@sami](https://community.smartthings.com/u/sami)\ **Post date:** [February 16, 2015, 5:49pm UTC](https://community.smartthings.com/t/oauth2-callback-for-smartapp/3917/6 "2015-02-16T17:49:44Z")
+1 Same issue here. I need to send a redirect\_uri which cannots contains variable parts ---
**Author:** ![mrhector](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@mrhector](https://community.smartthings.com/u/mrhector)\ **Post date:** [September 9, 2015, 5:29pm UTC](https://community.smartthings.com/t/oauth2-callback-for-smartapp/3917/7 "2015-09-09T17:29:31Z")
Curious if anyone has a recommended solution to this problem. I am trying to get OAUTH setup with Insteon but it requires the same redirect URI to be sent in the AUTH call as well as the call to retrieve the token. ---
**Author:** ![MightyJudge](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/mightyjudge/32/166374_2.png) [@MightyJudge](https://community.smartthings.com/u/MightyJudge)\ **Post date:** [November 19, 2015, 10:43am UTC](https://community.smartthings.com/t/oauth2-callback-for-smartapp/3917/8 "2015-11-19T10:43:57Z")
Is there still no solution to this? I’m having the same problem… The only solution I can think of is to set the redirect\_uri to somewhere outside the SmartThings cloud and then use information from the state to redirect it back into the cloud. ---
**Author:** ![Jim](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/jim/32/15313_2.png) [@Jim](https://community.smartthings.com/u/Jim)\ **Post date:** [November 19, 2015, 12:26pm UTC](https://community.smartthings.com/t/oauth2-callback-for-smartapp/3917/9 "2015-11-19T12:26:27Z")
@unixbeast just updated docs around this that should help: [http://docs.smartthings.com/en/latest/cloud-and-lan-connected-device-types-developers-guide/building-cloud-connected-device-types/building-the-service-manager.html](http://docs.smartthings.com/en/latest/cloud-and-lan-connected-device-types-developers-guide/building-cloud-connected-device-types/building-the-service-manager.html) ---
**Author:** ![mrhector](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@mrhector](https://community.smartthings.com/u/mrhector)\ **Post date:** [November 24, 2015, 5:39pm UTC](https://community.smartthings.com/t/oauth2-callback-for-smartapp/3917/10 "2015-11-24T17:39:30Z")
Thanks! Followed the tutorial and was able to get Oauth working for the Insteon Hub. Noticed when I install it on my mobile the embedded redirect works perfectly but if I try it on the ide/simulator it fails to redirect properly. Got around it by just outputting the link in the debug log and hitting it in a separate browser windows. The app in the simulator is then still able to answer the callback and receive the token just fine. Wasn’t sure if this is just a limitation of the ide/simulator or if there is anything I can do to have it work in the ide. ---
**Author:** ![MightyJudge](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/mightyjudge/32/166374_2.png) [@MightyJudge](https://community.smartthings.com/u/MightyJudge)\ **Post date:** [November 24, 2015, 6:50pm UTC](https://community.smartthings.com/t/oauth2-callback-for-smartapp/3917/11 "2015-11-24T18:50:16Z")
I have also worked through the page you mentioned and found it very helpful. A couple of slight points regarding the documentation that caused me a few headaches: In the preferences section of the example the page name is ‘Credentials’…. > preferences { > page(name: “Credentials”, title: “Sample Authentication”, content: “authPage”, nextPage: “sampleLoggedInPage”, install: false) > … > } however in the authPage example the dynamicPage name is ‘auth’, it appears these names have to match. > return dynamicPage(name: “auth”, title: “Login”, nextPage: “”, uninstall: false) { Also the refreshAuthToken() example is not complete as the ‘try’ requires a ‘catch’ and an extra ‘}’ is required. > catch(Exception e){ > Log.error(e) > } > } ---
**Author:** ![Jim](https://yyz2.discourse-cdn.com/smartthings/user_avatar/community.smartthings.com/jim/32/15313_2.png) [@Jim](https://community.smartthings.com/u/Jim)\ **Post date:** [November 24, 2015, 6:52pm UTC](https://community.smartthings.com/t/oauth2-callback-for-smartapp/3917/12 "2015-11-24T18:52:02Z")
Thanks @MightyJudge, tagging @unixbeast here since he knows more about this.