---
id: "projects/oauth-overview"
title: "OAuth"
description: "OAuth lets a third-party client access your RevenueCat account after you approve it. Use it when something like the RevenueCat MCP, the AI Toolkit, or another integration asks you to connect. If you're calling the REST API for your own project, create a secret API key instead."
permalink: "/docs/projects/oauth-overview"
slug: "oauth-overview"
version: "current"
original_source: "docs/projects/oauth-overview.md"
---

> **AI agents:** This is the Markdown version of a RevenueCat documentation page. For the complete documentation index, see [llms.txt](https://www.revenuecat.com/docs/llms.txt).

OAuth lets a third-party client access your RevenueCat account after you approve it. Use it when something like the RevenueCat MCP, the AI Toolkit, or another integration asks you to connect. If you're calling the REST API for your own project, create a [secret API key](https://www.revenuecat.com/docs/projects/authentication) instead.

## How OAuth works

When a client asks to connect, RevenueCat shows a consent screen. You choose which permissions the client gets and which projects it can use. After you approve, the client receives tokens that call the RevenueCat API as you, across the projects you granted.

OAuth access is tied to your account, not to a single project. A collaborator who authorized a client manages that connection on their own account. You can't revoke it for them.

OAuth is not a replacement for [API keys](https://www.revenuecat.com/docs/projects/authentication). API keys are project-specific credentials you create for your own app or backend. OAuth is how you grant a third-party client access without sharing those keys.

## Managing connected clients

You can review, edit permissions, and revoke connections from [Account → Security](https://app.revenuecat.com/settings/security) under **Active OAuth tokens**. Revoking immediately invalidates that token. The client can no longer call the API as you. See [Account security](https://www.revenuecat.com/docs/welcome/set-up-revenuecat/security#managing-oauth-tokens) for the steps.

If you authorized the same client more than once, each authorization is a separate row. Revoke each row you want to remove.

Access tokens expire after 1 hour. Refresh tokens expire after 30 days. If the client refreshes in time, RevenueCat issues a new pair and the connection stays active. A connection that keeps refreshing does not time out. Revoke it to disconnect the client.

## Creating an OAuth client

If you're building an OAuth client that other RevenueCat developers will connect to, you need to register it with RevenueCat. That's a separate workflow from connecting to an existing client.

See [Create an OAuth client](https://www.revenuecat.com/docs/projects/oauth-setup) for client registration, the authorization flow, scopes, and token refresh.

## Next steps

- [Revoke or edit a connection](https://www.revenuecat.com/docs/welcome/set-up-revenuecat/security#managing-oauth-tokens) from Account → Security
- [Set up the RevenueCat MCP](https://www.revenuecat.com/docs/tools/mcp/setup) if you're connecting an AI assistant
- [Create an OAuth client](https://www.revenuecat.com/docs/projects/oauth-setup) if you're building a third-party client
- [API keys](https://www.revenuecat.com/docs/projects/authentication) if you're calling the REST API yourself