Search code examples
smartsheet-apismartsheet-api-2.0

How can I add multiple App redirect uri within the Smartsheet Application for the purpose of using OAuth2.0?

I am building a Smartsheet connector that requires to use Oauth2.0 for authentication of user to access Smartsheet user data. I am able to add a single app redirect uri which is working as expected and authenticates successfully. However, I am unable to add multiple(more than 1) app redirect uri within the app profile. Is there any way to do so?

Thanks in advance.

Solution

  • At this time, Smartsheet only supports setting one App redirect URL per app.

    Smartsheet create new app

    However, there is a workaround if you need to be able to redirect users to different destinations, based on certain criteria.

    When you Request an Authorization Code as the first step of the OAuth process, include the state query string parameter -- setting its value to something that your app (@ the redirect URL you specified when creating the App in Smartsheet) can evaluate and then redirect from there to the appropriate location. If you include the state query string parameter like this when requesting an authorization code, then that same state query string parameter and value will be appended to the redirect URL that the user is sent to after interacting with the access request dialog.

    An Example:

    Let's assume that I set the App redirect URL to the following when I create the new app in Smartsheet:

    https://myappabc123.edu/ss-oauth

    Now let's say I want to be able to support different environments for my app (e.g. DEV, TEST, PROD). To do so, I'd include logic (in the page corresponding to the app redirect URL) to evaluate the state query string parameter value and redirect to the appropriate environment. Pseudo code may look something like this:

    if value of state parameter is "DEV":
  // redirect user to the DEV environment
else if value of state parameter is "TEST":
  // redirect user to the TEST environment
else if value of state parameter is "PROD":
  // redirect user to the PROD environment

    Then when initiating the OAuth process from my DEV environment, my app would append state=DEV to the authorization request:

    https://app.smartsheet.com/b/authorize?response_type=code&client_id=dheu3dmkd32fhxme&scope=READ_SHEETS%20WRITE_SHEETS&state=DEV

    The user will be presented with the access request dialog and when they make a choice (Allow or Deny), they'll be sent to the App redirect URL that you specified for the app (https://myappabc123.edu/ss-oauth)...with query string parameters that include the same state parameter value that you specified when you requested the authorization code to start the OAuth process. For example, if the user chooses Allow, they'll be redirected to:

    https://myappabc123.edu/ss-oauth?code=sample6p9qisx6a&expires_in=599080&state=DEV'

    Your app at https://myappabc123.edu/ss-oauth would evaluate the value of the state parameter (as described above in pseudo code) and redirect the user to the DEV environment.

    ----

    With this approach, the user technically gets redirected twice -- once to the App redirect URL you specified for the app, and a second time to the final destination (determined by the value of the state query string parameter and logic you define) -- but the process should be fairly seamless.

    ----------- UPDATE --------------

    Although I used different app environments (DEV, TEST, PROD) in my example above, the same methodology could be applied for many different scenarios. For example, in your first comment below you say that REGION may differ from one user to the next. In that case, you'd use the state query string parameter to pass the REGION value, then redirect from the initial App Redirect URL to the appropriate region-specific URL by reading the value from the state parameter to identify the proper region.

    If the approach I've described is logistically impossible for you -- i.e., because there's no initial Redirect URL that will be accessible to all users -- then your only other option at this time will be to create multiple "Apps" in Smartsheet (one for each region) and set the appropriate region-specific App Redirect URL for each one. This is obviously not ideal, but it's your only option (if using the approach I've described won't work for you) since Smartsheet only supports one App Redirect URL per app.