> ## Documentation Index
> Fetch the complete documentation index at: https://developers.pleo.io/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth 2.0 Access to Staging Workflow Guide

export const RememberCallout = ({title, children}) => <div className="callout-box callout-remember">
    <div className="callout-row">
      <span className="callout-icon">
        <svg width="22" height="22" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" fill="currentColor"><path d="M229.66,98.34,172.39,155.8c11.46,22.93-1.72,45.86-10.11,57a8,8,0,0,1-12,.83L42.34,105.76A8,8,0,0,1,43,93.85c29.65-23.92,57.4-10,57.4-10l57.27-57.46a8,8,0,0,1,11.31,0L229.66,87A8,8,0,0,1,229.66,98.34Z" opacity="0.2" /><path d="M235.32,81.37,174.63,20.69a16,16,0,0,0-22.63,0L98.37,74.49c-10.66-3.34-35-7.37-60.4,13.14a16,16,0,0,0-1.29,23.78L85,159.71,42.34,202.34a8,8,0,0,0,11.32,11.32L96.29,171l48.29,48.29A16,16,0,0,0,155.9,224c.38,0,.75,0,1.13,0a15.93,15.93,0,0,0,11.64-6.33c19.64-26.1,17.75-47.32,13.19-60L235.33,104A16,16,0,0,0,235.32,81.37ZM224,92.69h0l-57.27,57.46a8,8,0,0,0-1.49,9.22c9.46,18.93-1.8,38.59-9.34,48.62L48,100.08c12.08-9.74,23.64-12.31,32.48-12.31A40.13,40.13,0,0,1,96.81,91a8,8,0,0,0,9.25-1.51L163.32,32,224,92.68Z" /></svg>
      </span>
      <div>
        {title && <div className="callout-title">
            {title}
          </div>}
        <div className="callout-body">
          {children}
        </div>
      </div>
    </div>
  </div>;

export const RecommendedCallout = ({title, children}) => <div className="callout-box callout-recommended">
    <div className="callout-row">
      <span className="callout-icon">
        <svg width="22" height="22" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256" fill="currentColor"><path d="M229.06,108.79l-48.7,42,14.88,62.79a8.4,8.4,0,0,1-12.52,9.17L128,189.09,73.28,222.74a8.4,8.4,0,0,1-12.52-9.17l14.88-62.79-48.7-42A8.46,8.46,0,0,1,31.73,94L95.64,88.8l24.62-59.6a8.36,8.36,0,0,1,15.48,0l24.62,59.6L224.27,94A8.46,8.46,0,0,1,229.06,108.79Z" opacity="0.2" /><path d="M239.18,97.26A16.38,16.38,0,0,0,224.92,86l-59-4.76L143.14,26.15a16.36,16.36,0,0,0-30.27,0L90.11,81.23,31.08,86a16.46,16.46,0,0,0-9.37,28.86l45,38.83L53,211.75a16.38,16.38,0,0,0,24.5,17.82L128,198.49l50.53,31.08A16.4,16.4,0,0,0,203,211.75l-13.76-58.07,45-38.83A16.43,16.43,0,0,0,239.18,97.26Zm-15.34,5.47-48.7,42a8,8,0,0,0-2.56,7.91l14.88,62.8a.37.37,0,0,1-.17.48c-.18.14-.23.11-.38,0l-54.72-33.65a8,8,0,0,0-8.38,0L69.09,215.94c-.15.09-.19.12-.38,0a.37.37,0,0,1-.17-.48l14.88-62.8a8,8,0,0,0-2.56-7.91l-48.7-42c-.12-.1-.23-.19-.13-.5s.18-.27.33-.29l63.92-5.16A8,8,0,0,0,103,91.86l24.62-59.61c.08-.17.11-.25.35-.25s.27.08.35.25L153,91.86a8,8,0,0,0,6.75,4.92l63.92,5.16c.15,0,.24,0,.33.29S224,102.63,223.84,102.73Z" /></svg>
      </span>
      <div>
        {title && <div className="callout-title">
            {title}
          </div>}
        <div className="callout-body">
          {children}
        </div>
      </div>
    </div>
  </div>;

<RecommendedCallout title="Recommended Workflow">
  This guide applies **only to Pleo Partners**. All partner integrations must use **OAuth 2.0** as their authentication method.
</RecommendedCallout>

This workflow explains how **Pleo Partners** gain access to **Pleo’s Staging environment** and prepare their integration to authenticate using **OAuth 2.0**.

It focuses on **partner onboarding, environment access, and readiness**, not the OAuth 2.0 protocol itself. By the end, you’ll understand **what must be in place before your integration can authenticate and call Pleo APIs**.

## What You’ll Have Built

After completing this workflow, as a Pleo Partner:

* You have access to Pleo’s **Staging environment** with dummy data
* An OAuth 2.0 client is registered for your integration
* You have received an **OAuth 2.0 Client ID and Client Secret**
* You are ready to complete the OAuth 2.0 workflow and make authenticated API calls in Staging

## Who This Guide Is For

This guide is intended **exclusively for Pleo Partners** building **multi-customer integrations** with Pleo using **OAuth 2.0**.

It is not intended for Pleo customers building internal tools or single-company integrations.

The guide assumes:

* You do not yet have Staging access
* You are onboarding as a partner and preparing an integration for review

## Before You Start

You should be familiar with:

* Pleo’s role as an [Expense Management Solution](/docs/current/getting-started/platform-overview)
* The Pleo Partner [Early Access Programme (EAP)](/docs/current/getting-started/developer-partnership-programme)
* [OAuth 2.0 Overview](/docs/current/authentication/oauth/oauth-overview)

## Access to Staging Workflow Steps

### 1. Get Access to the Staging Environment (Partners Only)

**Purpose:**

Before you can build or test your integration, you must have access to **Pleo’s Staging environment**.

Staging mirrors production behaviour but uses dummy data, allowing **Pleo Partners** to develop and test integrations safely.

Access is granted as part of the **partner onboarding process** and includes registering your integration intent through the **Early Access Programme (EAP)**.

**Input:**

* Partner or company details
* Integration use case and intended API usage

**Output:**

* Login access to Pleo’s Staging environment
* A Staging company populated with dummy data

At this stage, your integration is authorised to request OAuth credentials but cannot yet call Pleo APIs.

**Integration Design / Why It Matters:**

* Staging access is required before OAuth credentials can be issued
* Dummy data ensures no real financial or accounting data is exposed
* EAP registration allows Pleo to review and support your integrations

<section className="mt-4">
  <a
    href="/docs/current/how-tos/environment-access/how-to-get-access-to-staging-oauth"
    className="group flex items-center justify-between rounded-md border border-gray-200 dark:border-gray-700 px-4 py-3
bg-gray-50 dark:bg-[#1f262b] hover:bg-[#ffe6ea] dark:hover:bg-[#2b1f23]
transition-colors"
  >
    <div>
      <p className="text-sm font-medium text-gray-900 dark:text-white">
        How to Get Access to Staging (OAuth 2.0)
      </p>

      <p className="text-xs text-gray-600 dark:text-gray-400">
        Onboard as a Pleo Partner and receive access to the Staging environment.
      </p>
    </div>

    <span className="ml-4 text-gray-400 group-hover:text-gray-600 dark:group-hover:text-gray-300">
      →
    </span>
  </a>
</section>

***

### 2. Complete OAuth 2.0 Setup

**Purpose:**

After gaining Staging access, your integration must **successfully complete the OAuth 2.0 authorisation flow** before it can call any APIs.

This ensures your integration can **authenticate securely** and obtain valid access tokens.

<RememberCallout title="Remember">
  The `Authorization: Bearer <token>` header must contain a valid OAuth 2.0 **access token** issued by Pleo. This is **not** the Client Secret and cannot be used until the OAuth 2.0 workflow has been completed.
</RememberCallout>

**How This Step Is Completed:**

You can complete OAuth 2.0 setup in one of two ways, depending on how you are building and testing your integration:

* [**Option A:**](/docs/current/guides/environment-access/staging-oauth-workflow#option-a-full-oauth-2-0-workflow-production-style-integration) Full OAuth 2.0 Workflow (Production-style Integration)
* [**Option B:**](/docs/current/guides/environment-access/staging-oauth-workflow#option-b-oauth-2-0-using-postman) OAuth 2.0 using Postman

**Outcome of This Step:**

By completing the linked guide, you will have:

* A valid OAuth 2.0 **access token** issued by Pleo
* Confirmation that your integration can authenticate successfully and call APIs within approved scopes

**Why This Matters:**

* OAuth 2.0 access tokens replace user credentials
* Tokens are scoped and time-limited to maintain security

#### Option A: Full OAuth 2.0 Workflow (Production-style Integration)

You'll cover:

* Directing users to the authorisation endpoint
* Exchanging authorisation codes for access tokens
* Handling refresh tokens and token expiry
* Making your first API call

<section className="mt-4">
  <a
    href="/docs/current/guides/oauth-workflow-guide#2-direct-users-to-authorisation-endpoint"
    className="group flex items-center justify-between rounded-md border border-gray-200 dark:border-gray-700 px-4 py-3
bg-gray-50 dark:bg-[#1f262b] hover:bg-[#ffe6ea] dark:hover:bg-[#2b1f23]
transition-colors"
  >
    <div>
      <p className="text-sm font-medium text-gray-900 dark:text-white">
        OAuth 2.0 Setup Workflow Guide
      </p>

      <p className="text-xs text-gray-600 dark:text-gray-400">
        Complete the OAuth 2.0 authorisation workflow.
      </p>
    </div>

    <span className="ml-4 text-gray-400 group-hover:text-gray-600 dark:group-hover:text-gray-300">
      →
    </span>
  </a>
</section>

#### Option B: OAuth 2.0 using Postman

You'll cover:

* Configuring Postman for OAuth 2.0
* Making your first API call using Postman

<section className="mt-4">
  <a
    href="/docs/current/guides/oauth-workflow-guide-postman#2-configure-postman-for-oauth-2-0"
    className="group flex items-center justify-between rounded-md border border-gray-200 dark:border-gray-700 px-4 py-3
bg-gray-50 dark:bg-[#1f262b] hover:bg-[#ffe6ea] dark:hover:bg-[#2b1f23]
transition-colors"
  >
    <div>
      <p className="text-sm font-medium text-gray-900 dark:text-white">
        OAuth 2.0 Setup with Postman
      </p>

      <p className="text-xs text-gray-600 dark:text-gray-400">
        Complete the OAuth 2.0 configuration in Postman.
      </p>
    </div>

    <span className="ml-4 text-gray-400 group-hover:text-gray-600 dark:group-hover:text-gray-300">
      →
    </span>
  </a>
</section>

***

## What Comes Next?

Once Staging access is confirmed and your integration can successfully call Pleo APIs using OAuth 2.0, you can continue with:

* **Export Expenses Workflow Guide** (coming soon)