# OAuth2

The Bare Bitcoin API has (limited) support for OAuth2, allowing
users to grant 3rd party applications access to their account, without having to set up API keys.

## Registering your application

Before integrating the Bare Bitcoin API using OAuth2, you need to register
your application by setting up an OAuth2 client. This is currently a manual
process. Reach out to hei@barebitcoin.no if this is of interest to you!

## URLs

* **Authorize URL**: `https://barebitcoin.no/rest/oauth2/v0/authorize`
* **Token URL**: `https://barebitcoin.no/rest/oauth2/v0/token`
* **Verify URL**: `https://barebitcoin.no/rest/oauth2/v0/verify`


# Scopes

We currently support five scopes:

- `api:accounts:bitcoin:read` lets you read the user's bitcoin accounts: their
names and balances. No transaction data!
- `api:trades:read` lets you read the user's completed trades (buys and sells).
- `api:tax:transactions:read` lets you read the transactions that are relevant
for tax reporting. This is the scope used by tax services such as
Kryptosekken.
- `api:deposits:lightning:read` lets you look up Lightning invoices on the
user's account, and see whether they have been paid.
- `api:deposits:lightning:write` lets you create Lightning invoices that pay
into the user's account.


When requesting authorization, pass the scopes you need as a
space-separated list in the `scope` parameter. You must request at least
one scope, and listing the same scope twice is rejected. The user is shown
a consent screen with a description of each scope you requested.

A user can have one active consent per client. If you later request a
different set of scopes, the existing consent is replaced and all access
tokens issued under it are invalidated, so the user has to go through the
authorization flow again.