How it works
In the common authorization code flow, the app redirects the user to the platform's consent screen. The user signs in and approves the requested scopes. The platform redirects back with a short-lived code, which the app exchanges for an access token and usually a refresh token. Access tokens expire quickly, and the refresh token is used to get new ones until the user revokes access.
Example
A customer clicks Connect QuickBooks, signs in to Intuit, approves accounting access, and returns to the product, which now holds tokens scoped to that one company file.
In integrations
Unify Connect runs OAuth flows for every supported platform in a white-label screen, stores tokens in a separate vault, handles refresh and revocation, and records consent: who connected what, when and with which scopes. Platforms that use API keys or desktop agents go through the same flow. Scopes matter. Request only what your product needs, explain why on the consent screen, and handle revocation cleanly, because security reviewers look at all three.