Snyk OAuth 2.0 connector profile – StackOne setup guide

Registering a Snyk App requires an existing Auth Token or Personal Access Token to call the registration API, and authorizing it requires admin access to the owning organization. A Snyk App only reaches the organizations, projects, and collections scopes it was registered with — it cannot read groups, roles, service accounts, invites, tenants, audit logs, or issues, unlike the Auth Token and Personal Access Token auth types.

Find your Snyk region

Snyk hosts accounts in several regional data centers, and an app only authorizes against its
own region. Your region is shown in your browser’s address bar whenever you are signed in to
Snyk — it is the host in the URL, the part between https:// and the first /. Match that
host to the Region you select below.

Sign in to Snyk and look at your browser’s address bar.
app.snyk.io → US (SNYK-US-01) — api.snyk.io
app.us.snyk.io → US (SNYK-US-02) — api.us.snyk.io
app.eu.snyk.io → EU (SNYK-EU-01) — api.eu.snyk.io
app.au.snyk.io → AU (SNYK-AU-01) — api.au.snyk.io

Register a Snyk App

Snyk has no page to create an OAuth app from. Its Authorized Snyk Apps settings page only
lists apps you’ve already authorized and points to the API docs to create one — the
Snyk Apps documentation confirms a Snyk App is
registered with a direct API call, not through the web UI.

Send a request to register the app for the organization that should own it, using an
Auth Token or Personal Access Token you already have. Run the following command,
replacing <org_id>, <your-region-api-host>, <your_token>, and <callback_url>
with your organization ID, region API host, token, and the Callback URL from your
Connector Profile:

curl -X POST 'https://<your-region-api-host>/rest/orgs/<org_id>/apps?version=2026-03-25' \
  -H 'Authorization: token <your_token>' \
  -H 'Content-Type: application/vnd.api+json' \
  -d '{
    "name": "StackOne Integration",
    "redirect_uris": ["<callback_url>"],
    "scopes": ["org.read", "org.project.read", "org.collection.read"]
  }'

name — a descriptive name for the app, such as StackOne Integration. Any name works; it is only a label.
redirect_uris — must include the Callback URL from your Connector Profile.
Format: https://<api-host>/connect/oauth2/snyk/callback
Example: https://api.stackone.com/connect/oauth2/snyk/callback
scopes — the permissions this integration needs.

The Snyk Authorized Snyk Apps settings page, showing no apps authorized yet and a link to the Snyk Apps API documentation.

Configure permissions

Enables actions: Add Projects To Collection, Create Collection, Delete Collection, Delete Project, Get Collection, Get Organization, Get Project, List Collection Projects, List Collections, List Organizations, List Projects, Remove Projects From Collection, Update Collection, Update Organization, Update Project

List in the scopes array only the permissions this integration needs.

Copy the Client ID and Client Secret

The response returns the app’s credentials under data.attributes.

Copy the Client ID (client_id in the response) into your Connector Profile.
Copy the Client Secret (client_secret in the response) into your Connector Profile — it is returned only once and cannot be retrieved later.

Create the StackOne Connector Profile

Create a Connector Profile

Enable the connector and create a Connector Profile in your project. See Setup Connector Profile.

Link an Account

Once the Connector Profile is created, continue to link an account.

​Find your Snyk region

​Register a Snyk App

​Create the StackOne Connector Profile

Find your Snyk region

Register a Snyk App

Create the StackOne Connector Profile