Skip to main content
Only owners and admins of a Lovable workspace can register OAuth clients. The project and workspace scopes are sensitive scopes, which need a Business or Enterprise workspace. Until Lovable verifies the client, users who connect see an unverified app warning.

​
Register the OAuth client

An OAuth client lets each user connect their own Lovable account to StackOne. Register one Web server client for StackOne in the workspace that will own it.

1

Sign in to Lovable

Sign in to your Lovable account as an owner or admin of the workspace.

2

Choose the application type

Select Web server as the application type.

  • A Web server client signs in with a client secret together with PKCE, which is how StackOne connects.
  • The application type cannot be changed after the client is registered.
3

Name the client

Enter a Client name such as StackOne Integration.

4

Add the redirect URI

Under Redirect URIs, enter the Callback URL from your Connector Profile.

  • Lovable only accepts https redirect URIs, apart from localhost addresses during development.
  • A client can have up to 10 redirect URIs.
5

Select the project and workspace scopes

Enables actions: Create Embed URL, Delete Project, Get Project, Get Project Analytics, Get Project Analytics Breakdowns, Get Project Realtime Analytics, Get Publish Status, Get Security Scan, Get User Info, Get Workspace, Get Workspace Analytics, Get Workspace Member, Get Workspace Security Insights, List Personal Data Findings, List Project Collaborators, List Projects, List Security Scan Findings, List Security Scans, List Workspace Groups, List Workspace Members, List Workspace Security Project Inventory, List Workspaces, Publish Project, Unpublish Project, Update Project, Update Publish Settings

Select each scope listed.

  • These are sensitive scopes, so they need a Business or Enterprise workspace.
  • A scope never gives a user more access than they already have in Lovable.
6

Select the sign-in and refresh scopes

Also select profile, email and offline.

  • StackOne requests these scopes every time a user connects.
  • offline lets Lovable issue a refresh token, so the connection keeps working after the access token expires. It must be on the client as well as in the request.
7

Register the client

Click Register client.

​
Copy the client credentials

The client details show the client ID and the client secret.

1

Copy the client ID and secret

Copy the Client ID and Client secret from the client details into the Client ID and Client Secret fields of your Connector Profile.

  • The client secret is shown only once. Store it before you leave the page.
2

Generate a new secret if you lose it

If you lose the secret, open the client and click Generate new secret under Client secret, then confirm.

  • The old secret stops working within a few seconds, so paste the new one into your Connector Profile straight away.
  • A Web server client has one active secret at a time.

​
Request verification

Required for: Create Embed URL, Delete Project, Get Project, Get Project Analytics, Get Project Analytics Breakdowns, Get Project Realtime Analytics, Get Publish Status, Get Security Scan, Get Workspace, Get Workspace Analytics, Get Workspace Member, Get Workspace Security Insights, List Personal Data Findings, List Project Collaborators, List Projects, List Security Scan Findings, List Security Scans, List Workspace Groups, List Workspace Members, List Workspace Security Project Inventory, List Workspaces, Publish Project, Unpublish Project, Update Project, Update Publish Settings

Clients with sensitive scopes show users an unverified app warning until Lovable verifies them. Request verification to remove the warning.

1

Request approval

Open the client’s details and click Request approval next to Verification.

  • An approved client shows Verified by Lovable.
  • A denied request shows Approval denied. Click Edit client to change the client, then request approval again.
  • If Lovable does not decide within five days, the request expires and you can submit it again.
  • Later edits that add sensitive scopes to a verified client go to review. The current settings stay active until Lovable approves them, and the edits show under Pending changes.

​
Creating the StackOne Connector Profile

To create the Connector Profile in StackOne for Lovable:
1

Open the connector

Log in to StackOne, open Connectors, and select Lovable.
2

Choose actions and events

  • Click Add Profile.
  • If the connector offers more than one authentication method, set the Auth Method filter to OAuth 2.0.
  • Select the actions, and any events, to enable for this Connector Profile.
  • Click Continue.
3

Set up authentication

  • Select Authentication Type as OAuth 2.0.
  • Fill out the fields using details retrieved from your provider:
    • Client ID
    • Client Secret
    • Scopes (Optional)
  • Click Create Profile.
Congratulations! The new Connector Profile now shows up on the connector page. If you created it as a project member rather than an admin, it starts disabled until a project admin enables it. You can now continue to Link Accounts for Lovable.