1. Enable the cors scope

To make cross-origin calls from the frontend, your OAuth client must have the cors scope enabled. This scope is enabled by Mapaprop on your credentials: if your application needs it, contact us.

Without the cors scope, calls from the browser will be rejected by the CORS policy.

2. How to send the token

In browser calls you can send the token in two ways (we recommend both at the same time):

• Header Authorization: Bearer {access_token}
• Query param oauth_token={access_token} in the URL

Resource URL (with token as query param)

https://mapaprop.app/api/action/express-v1/settings-v2?oauth_token={access_token}

Sample code

GET /api/action/express-v1/settings-v2?oauth_token={access_token} HTTP/1.1
Host: mapaprop.app
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
Authorization: Bearer {access_token}

Example from JavaScript:

const token = 'YOUR_ACCESS_TOKEN';
const res = await fetch(
  `https://mapaprop.app/api/action/express-v1/settings-v2?oauth_token=${token}`,
  { headers: { Authorization: `Bearer ${token}` } }
);
const settings = await res.json();