OAuth for the Reputation Management Kit

The Reputation Management Kit allows partners to act on behalf of an individual Tripadvisor member: posting an owner response and reporting a review. If you're only using content endpoints — Location Details, Reviews, Photos, feeds — nothing here applies to you.

Partner Flow

Every Reputation Management Kit partner uses the authorization code grant with PKCE. There's no client secret — your client is registered as a public client, and PKCE stands in as your proof of possession. This is standard for integrations that can't reliably keep a secret confidential, which covers most partner setups here: single-page apps, mobile apps, and server-side integrations that would rather not manage secret rotation.

Registering your client

Before you can call any OAuth-protected endpoint in the kit, we need to register a client for you. Send your account team:

We need	Why
Client name	Show to the TA member on the consent screen
Redirect URI(s)	One per environment (staging, production). Matching is an exact string comparison — no wildcards — so send the literal callback URL, scheme and path included.
Scope(s) you need	See the table below; it should match the access terms agreed in your contract. If you need more than one, expect separate clients — scopes carry different token lifetimes and get registered independently.
Confirmation you support PKCE	Your app has to generate a `code_verifier` / `code_challenge` pair (S256). If your stack can't do this, please discuss this before implementation.

Once registration is done, you'll get a client_id.

Available scopes

Scope	Covers	Available
`owner-responses:write`	Posting and deleting owner responses	Owner Response API
`owner-responses:read`	Fetching and displaying an owner response	Owner Response API
`owner-property:review:report`	Reporting reviews by listing owners	Owner Response API

Step-by-step

Generate a PKCE pair. Create a random code_verifier, derive code_challenge = BASE64URL(SHA256(code_verifier)), and use code_challenge_method=S256.
Redirect the user's browser to the authorization endpoint:

GET https://accounts.tripadvisor.com/oauth2/authorize
  ?response_type=code
  &client_id=<your_client_id>
  &redirect_uri=<your_registered_redirect_uri>
  &scope=<reviews:write or owner-responses:write>
  &code_challenge=<code_challenge>
  &code_challenge_method=S256

User authenticates and consents. The user sees a consent screen naming the client and the single scope requested).
Handle the callback. On success, the browser is redirected to the registered redirect_uri with code. Exchange it for a token:

POST https://accounts.tripadvisor.com/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=<code>
&redirect_uri=<same redirect_uri as step 2>
&client_id=<your_client_id>
&code_verifier=<code_verifier from step 1>

The response contains an access_token (JWT) scoped to whichever scope was requested and consented to.

Use the token. Include Authorization: Bearer <access_token> when calling the resource API on the user's behalf.

If the user declines consent, the callback receives error=access_denied instead of code. Authorization codes are single-use and short-lived — a reused or expired code fails the token exchange with invalid_grant.