Skip to main content
OAuth 2.0 is an industry-standard authorisation framework that allows applications to access Pleo data securely on behalf of a customer, without requiring the customer to share their login credentials. Instead of passwords, OAuth 2.0 uses access tokens, which grant limited, controlled access to specific resources and actions. This allows integrations to operate securely while ensuring customers remain in control of their data. OAuth 2.0 is the recommended authorisation method for most Pleo integrations.

​
When to use OAuth 2.0

You should use OAuth 2.0 if your integration needs to:
  • Access Pleo APIs on behalf of a customer
  • Allow customers to connect their Pleo account to your application
  • Access or modify customer data, such as expenses, employees, or accounting information
  • Maintain secure, long-lived access without storing user credentials
OAuth 2.0 ensures customers explicitly grant permission and can revoke access at any time. Alternative authentication methods, such as Integrated API keys, may be used in limited scenarios.

​
How OAuth 2.0 protects customer data

OAuth 2.0 improves security by:
  • Never exposing user passwords to third-party applications
  • Issuing access tokens with limited permissions
  • Allowing integrations to request only the access they need using API scopes
  • Allowing access to be revoked without affecting user login credentials
This ensures integrations operate within clearly defined permission boundaries.

​
OAuth 2.0 roles (as used by Pleo)

OAuth 2.0 defines four roles involved in granting and using access:
  • Resource Owner
    The Pleo customer who owns the data and grants access to it.
  • Client
    The third-party application requesting access to Pleo data.
  • Authorisation Server
    Pleo’s service that authenticates users, collects consent, and issues access tokens.
  • Resource Server
    Pleo APIs that store and provide access to protected data.

​
What happens when a customer connects your integration

At a high level:
  1. Your application directs the customer to Pleo to approve access
  2. The customer reviews and approves the requested permissions
  3. Pleo issues access tokens to your application
  4. Your application uses those tokens to access Pleo APIs securely
The customer can revoke access at any time.

​
What Comes Next?

Once you decide to use OAuth 2.0, the next step is to design and implement the integration correctly. See: