Passing STATE via Oauth

We’ve had a number of questions lately around our Oauth and does it support state?

State is an additional parameter that a developer can use to pass additional information eg: user ID, on a ‘round trip’ through the Oauth and back to their code. The minimum length for the state parameter is 8 characters.

Great news - YES our Oauth server supports this.

To add the state parameter you would change the URL link from

https://secure.myob.com/oauth2/account/authorize?client_id=[YOUR API KEY]&redirect_uri=[URL_ENCODED_REDIRECT_URI]&response_type=code&scope=[SME_SCOPES]

to this - by simply adding &state=

https://secure.myob.com/oauth2/account/authorize?client_id=[YOUR API KEY]&redirect_uri=[URL_ENCODED_REDIRECT_URI]&response_type=code&scope=[SME_SCOPES]&state=[URL_ENCODED_STATE_VAR]

Please note: As of 12th March, all new API keys created after 12th March 2025 must be authenticated with new scopes. [SME_SCOPES] in the above URL must be one or more of the new new scopes, and the CompanyFile scope will no longer work. For all keys created prior to 12th March 2025, the scope CompanyFile should be used and the new scopes will not work for keys created prior to 12th March 2025.