Examplary
  • Start for free
    Developer docs

    OAuth tokens are now scoped to a single workspace

    When a user authorizes your integration and belongs to more than one Examplary workspace, the consent screen now asks which workspace to grant access to. The token you receive back is tied to that one workspace. Until now a token could reach any of the user's other workspaces by passing an X-Examplary-Org header or ?org= query parameter; now anything other than the token's own workspace returns 403, and GET /orgs lists only that workspace.

    If your integration relied on switching workspaces with that header or parameter, it will need the user to authorize again for each workspace it works with. Users who belong to a single workspace are unaffected and skip the picker entirely. The OAuth guide walks through the full authorization flow.