What Is OAuth?
OAuth is an authorization framework that lets a third-party application access data on your behalf, without you sharing your ITrack password with that application. Instead of handing over credentials, you approve the connection through ITrack itself, and ITrack issues the third-party app a time-limited token it uses to authenticate.
Think of an OAuth token like a valet key. You give the parking attendant a key that works for driving the car but won't open the glove box. The valet never knows your house key combination, and you can take the valet key back at any time.
How OAuth Is Implemented in ITrack
ITrack exposes a standard OAuth 2.1 authorization code flow with PKCE for third-party integrations. The primary use case today is the ITrack MCP server, which allows AI apps (such as Claude or ChatGPT) to query and interact with your ITrack data.
The Authorization Flow
When a third-party app wants access to ITrack, the user experience looks like this:
-
The app redirects you to an ITrack login/authorization page (similar to the standard Enterprise Web login window).
-
You log in with your normal ITrack credentials. These go directly to ITrack, never to the third-party app.
-
The ITrack login screen also presents an authorization option where you choose what level of access to grant.
-
You approve (or deny). ITrack then issues an access token to the app.
-
The app uses that token for subsequent API calls. Your credentials are never shared.
Access Scopes: Choosing What You Share
When you authorize a third-party app, you select a scope, which is the level of access you're granting:
|
Scope |
What It Allows |
|---|---|
|
Read |
Read-only access. The app can query ITrack data (inventory lookups, customer info, reports, etc.) but cannot create, modify, or delete anything. |
|
Read + Write |
Full access. The app can read data and also make changes (create documents, add notes, etc.). Write access inherently includes read access. |
Read + Write access is currently in development and is not available yet, but will be coming soon.
Recommendation: Grant only the scope the integration actually needs. Most reporting or AI tools only require Read access. If an app is asking for Read + Write, make sure you understand why.
How Scopes Are Enforced
Scopes are enforced at the API level via GraphQL:
-
Read scope → access to GraphQL Queries only
-
Read + Write scope → access to GraphQL Queries and Mutations
This is enforced server-side, so even if an app has a bug or a bad actor attempts an unauthorized operation, ITrack will reject the request if the token's scope doesn't allow it.
Service Accounts (Machine-to-Machine Access)
Some integrations don't act on behalf of a specific user, they run as background services or system processes. For these, ITrack supports service accounts using the OAuth client_credentials flow.
A service account gets its own credentials (a client ID and secret) and obtains tokens directly from ITrack without any user login step. This is appropriate for:
-
Automated data exports or syncs
-
Backend system integrations
-
Any process that runs unattended without a logged-in user
Currently, service accounts are provisioned by ISoft, there is no self-service setup yet. If you need a service account for an integration, please contact us.
Revoking Access
If you need to revoke a third-party app's access to ITrack, the associated session in ITrack needs to be closed. This invalidates the token, and the app will no longer be able to authenticate until re-authorized. Token revocation is also triggered when a user session is closed normally.
Future versions of ITrack Enterprise Web will include a self-service interface for managing authorized applications and revoking access.
The ITrack MCP Server
The primary production use of OAuth in ITrack today is the ITrack MCP server, a component that allows AI app(such as Claude or ChatGPT) to securely connect to your ITrack Enterprise data.
When the MCP server connects to ITrack, it authenticates via OAuth rather than storing your credentials. The MCP server presents its client credentials to ITrack, receives a bearer token, and uses that token for all subsequent API calls. This means:
-
No ITrack passwords are stored in the AI tool or MCP configuration
-
Access can be revoked at any time by closing the session or revoking the token
-
The scope of AI access is limited to what was authorized at setup time
Read more about AI Connectors