Procore OAuth and DMSA Boundary

Overview

Select authentication from the actor model, not implementation convenience. User-facing applications normally use Authorization Code, while unattended connectors use Client Credentials through a Developer Managed Service Account whose manifest permissions bound access.

Prerequisites

• Named application owner and classified user-facing or headless workload
• Exact company-level and project-level tools the workload must access
• Approved callback, secret store, token cache, rotation owner, and revocation path

Instructions

Step 1: Choose the grant

Use Authorization Code when the integration acts as a Procore user. Use Client Credentials only for a DMSA or explicitly governed service account that operates without user context.

Step 2: Define least privilege