# Apps

> Build an app that STX members connect to their account, with scoped, revocable access they approve on STX.

Source: https://docs.stxapp.io/apps/overview/

> **Availability.** Available on US demo now. Live access is coming soon in the US and Ontario. See [Environments](https://docs.stxapp.io/environments/).

**An app acts on behalf of other STX members, using OAuth.** Your users keep their own STX accounts and connect them to your app. They sign in on STX, approve the access you ask for, and can disconnect at any time. You never see their password, their keys or their funds, and nothing your app holds can move money.

How the protocol works, from the authorization code flow to scopes, tokens and errors, is covered under [OAuth](/oauth/), in this section. These pages cover what you get and how to get access.

## What you get

- **Scoped access.** Named slices of a member's account, such as `profile.read`, `balance.read`, `orders.read` and `orders.write`. You ask for the fewest you need, and every token is confined to them. No scope moves money. See [Scopes](/oauth/scopes/).
- **Consent hosted by STX.** Sign-in, sign-up, two-factor and the consent screen all run on STX. Members see your app's name and logo, and can revoke it from **Connected apps** in their account. See [Hosted pages](/apps/hosted-pages/).
- **Member and app tokens.** A member token to act for one member, a refresh token to keep that access alive, and an app token to read the market and event catalogue as your app. See [Tokens and security](/oauth/tokens-and-security/).
- **The same API.** An access token is a bearer on the same [REST API](/api/rest/) and [WebSocket channels](/websockets/) a signed request uses, limited to the scopes the member approved.
- **Attribution.** Every order your app places for a member is recorded as placed by your app.
- **TypeScript and Python SDKs.** `@stxapp/stx-typescript` and `stx-python` run the whole flow for you, from linking a member to refreshing and revoking their tokens. See [With the TypeScript SDK](/apps/typescript-sdk/) and [With the Python SDK](/apps/python-sdk/).

## Access

Access is self-serve. Sign up at [apps.stxapp.io](https://apps.stxapp.io) (STX Apps), confirm your email, create your organization and register your app, and you get demo credentials, for the US demo exchange and a member account with test funds to connect. Live access is coming soon in the US and Ontario; in Ontario an app reads public market data only and does not act for members.

### Get demo access

Register your app in [STX Apps](https://apps.stxapp.io/developers) with:

- an application **name** and **logo**, shown to members on the consent screen and in Connected apps;
- its **application type**, from the table below;
- one or more **callback URLs** (redirect URIs), where STX returns the member after consent. They are matched exactly, byte for byte, at both the authorize and token steps, except a local callback (`localhost`, `127.0.0.1`, `[::1]`), which matches on any port. The allowed forms depend on your application type. None for a Server-to-server app. No fragment;
- the **scopes** your app may ever request: member scopes, app scopes, or both. Every request is narrowed against this list;
- the **IP addresses** your app writes from, as CIDR blocks (`203.0.113.0/24`, `2001:db8::/32`; no wider than /8 for IPv4 or /32 for IPv6). Required for a write scope (`orders.write`, `markets.write`), optional otherwise. Calls that write from any other address are refused with `403 ip_not_allowed`; reads and token requests work from any address. See [IP allow-list](/oauth/ip-allow-list/). Developing locally? Add your own public IP.

You receive a `client_id` and, for a Web app or Server-to-server app, a one-time `client_secret`. The secret is shown once and cannot be recovered; store it on your server. Rotating it invalidates the old one immediately.

### Application types

| Type | For | Client secret | Callbacks in production |
| --- | --- | --- | --- |
| Web app | an app with its own server | yes | `https` only |
| Browser app | a single-page app with no server | no, PKCE only | `https` only |
| Mobile or desktop app | an installed app | no, PKCE only | `https` link, reverse-domain custom scheme (`com.example.app:/callback`), or `http://localhost` / `127.0.0.1` / `[::1]` on any port. See [Callbacks for mobile and desktop apps](/apps/mobile-and-desktop-callbacks/) |
| Server-to-server | your backend, no member sign-in (`client_credentials`) | yes | none |

The type is fixed at registration. Outside production, every type with callbacks may also register `localhost`, `127.0.0.1` and `[::1]` callbacks (http or https) that match on any port, so you can develop locally.

## What it takes to integrate

1. **Get a demo client** in STX Apps (see [Get demo access](#get-demo-access)).
2. **Start from where you are**: [an app with its own accounts](/oauth/connect-your-stx-account/), [a new app with no login yet](/oauth/sign-in-with-your-stx-account/), or [an app on a login service](/oauth/sign-in-with-your-stx-account/login-vendor/). Each runs the [authorization code flow](/oauth/authorization-flow/) to turn a member's consent into tokens.
3. **Call STX for the member** with the access token as a bearer on `/api/v1` and the WebSocket, limited to the [effective scope](/oauth/scopes/#effective-scope).
4. **Keep access alive** by refreshing, and drop it cleanly when the member disconnects. See [Tokens and security](/oauth/tokens-and-security/).

## Sample app

[Sideline](https://github.com/stxapp/stx-isv-demo) is a demo app built on STX OAuth, published as a public example. It links a member's account from its backend, reads their balance, positions and orders, places and cancels orders for them, streams their account data, reads public market data on its own app token, and unlinks on request. It is built on the [TypeScript SDK](/apps/typescript-sdk/) and runs against the demo exchange with your demo client.

Try it live at [sideline.sportsxapp.com](https://sideline.sportsxapp.com). It runs against the US demo exchange: to link an account, sign up on [demo.stxapp.io](https://demo.stxapp.io) first. No real money is involved.

## In this section

- [Hosted pages](/apps/hosted-pages/): Consent, sign-in and sign-up, and Connected apps, all hosted by STX.
- [Callbacks for mobile and desktop apps](/apps/mobile-and-desktop-callbacks/): Universal links and App Links, a custom scheme, or loopback, with iOS, Android and desktop examples.
- [With the TypeScript SDK](/apps/typescript-sdk/): Connect a member's STX account or sign them in with it, act for them, and disconnect, with @stxapp/stx-typescript.
- [OAuth](/oauth/): Start from where you are, then the protocol underneath: authorization code flow, scopes, tokens, discovery and errors.