What you get
Set up OAuth once — and work with any Bitrix24 customer's account.
One flow for all customers
One flow for all customers
Implement the OAuth flow once and work with any Bitrix24 customer's account. No need to set up webhooks separately for each one — the customer grants access themselves with a single click.
Standard OAuth, nothing to reinvent
Standard OAuth, nothing to reinvent
Authorization Code — the same flow as Google and GitHub. Any OAuth framework works. State against CSRF, the secret (when there is one) stays on the server, and the key can be revoked.
Granular access, not all-or-nothing
Granular access, not all-or-nothing
Request only what the feature needs: CRM, tasks, telephony, drive, AI. A corporate security officer sees specific permissions, not “full access to the Bitrix24 account”.
Vibecode API under the hood
Vibecode API under the hood
One key unlocks 300+ Vibecode API methods: 50 entities with CRUD, batches of up to 50 calls, MongoDB-style filters, auto-pagination. Not the raw Bitrix24 REST.
How it works
Standard OAuth Authorization Code — the same flow as Google and GitHub.
Redirect to consent
Redirect the user to /v1/connect/authorize with client_id, redirect_uri and the scopes you need. An app without a secret adds a code_challenge there too.
The user confirms
The customer sees the consent page, picks a Bitrix24 account and approves the requested permissions as a whole.
The code comes back
Alaio Vibecode redirects the customer back to your redirect_uri with the code and state parameters.
Exchange for a key
Your server makes a POST /v1/connect/token with the code and receives a permanent Vibecode API key. With a secret — the client_secret; without one — that same one-time pair of strings.
For any kind of app
A server-side service, a mobile app with no secret, or a device with no browser — the flow adapts to the client type.
Server-side service
The classic flow: the secret lives on your server and never reaches the user.
Mobile or desktop app
No secret: every sign-in generates a one-time pair of strings (the PKCE mechanism). The redirect goes back to localhost on any port.
Device with no browser
Sign-in with a short code. The platform enables it for verified apps — request verification in your cabinet, and device sign-in is switched on with it on request.
- The key does not expire — it works until it is revoked
- Up to 10 apps per account by default
- Your customer stays in control — one click in their profile revokes access
What partners build
Three typical uses of the OAuth channel.
External AI assistant
An AI agent works in your service's chats or interfaces with the context of the customer's Bitrix24 account. It sees deals, tasks and contacts — helping the manager without leaving your tool.
BI and analytics
An external dashboard reads the customer's Bitrix24 account data and builds custom reports — revenue, conversion, manager activity. No data copying or manual exports.
Cross-system integrations
Connect Bitrix24 with an external CRM, ERP, messengers, marketing systems or the customer's Telegram bots. One OAuth channel — for any number of customer Bitrix24 accounts.