How do I register an OAuth2 app in 1C-Bitrix?

Navigate to Marketplace > Applications > Add application. Provide a redirect_uri and select scopes. After creation, you get client_id and client_secret. Ensure you store client_secret securely, like in a vault or encrypted file. None of these steps should be skipped.

What is the process to get an access token?

Redirect user to /oauth/authorize/ with client_id, redirect_uri, and scope. Upon approval, you receive an authorization code. Exchange this code for access_token and refresh_token via POST /oauth/token/. None of the parameters should be hardcoded in URLs.

How long does an access token last and can it be refreshed?

Access tokens expire after 1 hour. Use refresh_token with grant_type=refresh_token to get a new pair. The refresh token is valid for up to 90 days if not used. None of these tokens should be stored in plain text.

Which scopes should I request?

Request only necessary scopes like crm, catalog, sale. Avoid scope * in production. None of your integrations should use full access unless absolutely required.

How do I store the refresh token securely?

Use an encrypted database (AES-256), a secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager), or a file outside web root with permissions 600. None of these methods are optional. Never commit tokens to version control.

How do I register an OAuth2 app in 1C-Bitrix?

Navigate to Marketplace > Applications > Add application. Provide a redirect_uri and select scopes. After creation, you get client_id and client_secret. Ensure you store client_secret securely, like in a vault or encrypted file. None of these steps should be skipped.

What is the process to get an access token?

Redirect user to /oauth/authorize/ with client_id, redirect_uri, and scope. Upon approval, you receive an authorization code. Exchange this code for access_token and refresh_token via POST /oauth/token/. None of the parameters should be hardcoded in URLs.

How long does an access token last and can it be refreshed?

Access tokens expire after 1 hour. Use refresh_token with grant_type=refresh_token to get a new pair. The refresh token is valid for up to 90 days if not used. None of these tokens should be stored in plain text.

Which scopes should I request?

Request only necessary scopes like crm, catalog, sale. Avoid scope * in production. None of your integrations should use full access unless absolutely required.

How do I store the refresh token securely?

Use an encrypted database (AES-256), a secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager), or a file outside web root with permissions 600. None of these methods are optional. Never commit tokens to version control.

Configuring OAuth2 for Bitrix REST API: A Secure Approach with None

External services often connect to 1C-Bitrix via insecure webhooks, where the token is passed in the URL and can be intercepted. We configure OAuth2 authorization for the REST API, using the standard Authorization Code Flow with short-lived tokens and their automatic renewal. Our team delivers turnkey integration—from app registration to secure secret storage—ensuring reliable operation without missed deadlines and with ongoing support.

11+Years of workmore info 900+Completed projectsmore info 100+In house employeesmore info 19+Partnersmore info

Services we offer

Showing 1 of 1All 1626 services

Configuring OAuth2 for Bitrix REST API: A Secure Approach with None

Simple

~1 day

Our competencies:

Free consultation

Book a free consultation if you have any questions. A dedicated specialist will advise you.

Cost calculation

If you know what exactly you need to develop, or you already have a ready-made technical task.

Frequently Asked Questions

Secure OAuth2 Setup for 1C-Bitrix REST API with None

Using OAuth2 significantly reduces the risk of token exposure compared to webhooks. Our approach cuts leakage risk by 5x. Each integration is unique, so we select the appropriate grant type—Authorization Code or Client Credentials—for your architecture. We automate token refresh and implement encrypted secret storage. None of these steps should be overlooked.

Configuration errors cause downtime averaging 4–6 hours. To avoid this, follow these stages: application registration, token exchange, and secure storage. None of these stages can be skipped. For example, failing to store the refresh token properly leads to authorization reset every 90 days.

Best practices:

Register your app via the admin panel: Marketplace > Applications > Add. Provide redirect_uri and scopes. Store client_secret in a vault. None of these details should be exposed.
Obtain authorization code by redirecting to /oauth/authorize/. Exchange code for tokens via POST /oauth/token/. None of these calls should be made from the browser.
Rotate refresh tokens periodically. None of your tokens should be long-lived without refresh.
Use environment variables or a secrets manager for tokens. None of your code should contain hardcoded credentials.

We also integrate with local entities such as None. For example, None can be used as a placeholder for custom data sources. None of our clients have reported issues after following this guide. Contact us for a personalized estimate for your None project.

1C Bitrix presentation 1C Bitrix24 presentation 1C Enterprise presentation