Using OAuth 2

The Meetup API supports authenticating requests using OAuth 2 over HTTPS.

We provide implementations a number of protocol flows outlined below. We provide the following endpoints for acquiring member authorization and access tokens.

Redirect URIs

Before you can use OAuth 2 for member authorization, you need to either register a new OAuth client or add a redirect_uri to an existing client by clicking the edit link next to you client's listing. The redirect_uri you register for a given client will be used to validate future oauth2 requests.

This uri is used as a basis for validating the address authorization requests will redirect a member to after granting or denying access to your app.

If provided, the redirect URL's host and port must exactly match the callback URL. The redirect URL's path must reference a subdirectory of the callback URL.

CALLBACK: http://example.com/path
GOOD: http://example.com/path
GOOD: http://example.com/path/subdir/other
BAD:  http://example.com/bar
BAD:  http://example.com/
BAD:  http://example.com:8080/path

Making requests

OAuth 2 authenticated requests expect an Authorization header with value in the following format.

Authorization: bearer {ACCESS_TOKEN}

Example

Authorization: bearer abcdefghijklmnop

You can obtain an access token using one of the following flows.

Server Flow

This flow is suitable for applications that are capable of securely storing consumer secrets and target interactive member authentication.

Requesting Authorization

Redirect your user to the following URL in a browser:

https://secure.meetup.com/oauth2/authorize?client_id={YOUR_CLIENT_KEY}&response_type=code&redirect_uri={YOUR_CLIENT_REDIRECT_URI}

The redirect_uri used here may vary but must start with the same redirect_uri you have registered with your consumer.

Meetup will ask the member to login if they are not already logged in. If the member has previously authorized access for the provided client_id, Meetup will immediately redirect the member back to the redirect_uri with success query parameters. If the authenticated member has not previously authorized the provided client or has revoked its access, Meetup will prompt them to authorize your application. Afterwords, Meetup will redirect the member back to the provided redirect_uri along with their response.

A successful authorization will contain these query parameters:

A failed authorization will contain an optional state parameter (mentioned above) as well as an error query parameter with one of the following values:

Requesting Access Token

Have your server make an HTTP application/x-www-form-urlencoded encoded POST request for an access token with the following format:

https://secure.meetup.com/oauth2/access

client_id={YOUR_CLIENT_KEY}
&client_secret={YOUR_CLIENT_SECRET}
&grant_type=authorization_code
&redirect_uri={SAME_REDIRECT_URI_USED_FOR_PREVIOUS_STEP}
&code={CODE_YOU_RECEIVED_FROM_THE_AUTHORIZATION_RESPONSE}

The important parameter to note is grant_type which should be set to authorization_code. The redirect_uri used in this step must be the same redirect_uri used in the previous step.

We also support the usage of query string parameters for this method.

A successful response will contain the following data in application/json format

{
  "access_token": "{ACCESS_TOKEN_TO_STORE}",
  "token_type": "bearer",
  "expires_in": 3600,
  "refresh_token": "{TOKEN_USED_TO_REFRESH_AUTHORIZATION}"
}

A failure response will contain an application/json encoded string with an error property containing one of the following values