OAuth
Connect a third-party client to your RevenueCat account, and revoke that access when you no longer need it.
OAuth lets a third-party client access your RevenueCat account after you approve it. Use it when something like the RevenueCat MCP, the AI Toolkit, or another integration asks you to connect. If you're calling the REST API for your own project, create a secret API key instead.
How OAuth works
When a client asks to connect, RevenueCat shows a consent screen. You choose which permissions the client gets and which projects it can use. After you approve, the client receives tokens that call the RevenueCat API as you, across the projects you granted.
OAuth access is tied to your account, not to a single project. A collaborator who authorized a client manages that connection on their own account. You can't revoke it for them.
OAuth is not a replacement for API keys. API keys are project-specific credentials you create for your own app or backend. OAuth is how you grant a third-party client access without sharing those keys.
Managing connected clients
You can review, edit permissions, and revoke connections from Account → Security under Active OAuth tokens. Revoking immediately invalidates that token. The client can no longer call the API as you. See Account security for the steps.
If you authorized the same client more than once, each authorization is a separate row. Revoke each row you want to remove.
Access tokens expire after 1 hour. Refresh tokens expire after 30 days. If the client refreshes in time, RevenueCat issues a new pair and the connection stays active. A connection that keeps refreshing does not time out. Revoke it to disconnect the client.
Creating an OAuth client
If you're building an OAuth client that other RevenueCat developers will connect to, you need to register it with RevenueCat. That's a separate workflow from connecting to an existing client.
See Create an OAuth client for client registration, the authorization flow, scopes, and token refresh.
Next steps
- Revoke or edit a connection from Account → Security
- Set up the RevenueCat MCP if you're connecting an AI assistant
- Create an OAuth client if you're building a third-party client
- API keys if you're calling the REST API yourself