Skip to main content
Meridian supports the authorization code grant with optional refresh tokens. All applications are confidential clients and require a client secret. Public clients are not supported.

​
Credentials

Create and manage apps at developer.meridian.surf.

​
Redirect URIs

  • At least one redirect URI is required per application.
  • Production URIs must use https://.
  • Authorization requests must match a registered URI exactly (path included). Meridian appends query parameters on callback.
Register every callback URL your app uses. Meridian does not support wildcard or pattern matching.

​
Authorization

​
string
required
Your application’s client id from the developer portal.
​
string
required
Must exactly match a URI registered on the application.
​
string
required
Must be code.
​
string
required
Space-separated list of scopes.
​
string
Opaque value returned unchanged on redirect. Use this on every request for CSRF protection.
​
string
Set to skip to bypass the consent screen when the user has already granted the requested scopes. If additional scopes are needed, Meridian redirects with error=consent_required.

​
Success redirect

Authorization codes expire after 5 minutes and are single-use.

​
Error redirects

​
PIN unlock

These scopes require the user to unlock their session PIN before authorization:
  • user.email
  • user.connections.read
  • Any scope ending in .write or .manage

​
Tokens

Accepts application/json or application/x-www-form-urlencoded. Refresh token rotation is enabled. Each successful refresh revokes the previous refresh token. Reusing a revoked refresh token revokes the entire token family.

​
Revoke

Send token (required) and optional token_type_hint (access_token or refresh_token). Returns 200 with an empty body on success (RFC 7009). Revoking a refresh token revokes its entire token family.

​
Security

  • Store client secrets server-side only. Never ship them in client-side code or mobile apps.
  • Send state on every authorization request.
  • Exchange authorization codes immediately.
  • Rotate client secrets if you suspect exposure. Rotation invalidates the old secret immediately.
  • Treat access tokens as bearer credentials.
  • Do not log client secrets, authorization codes, or access tokens.
Last modified on August 9, 2026