We’re developing a new Self-Hosted Web Service add-on for ServiceM8, using Cloudflare Workers as the backend.
We’re experiencing a problem completing the initial OAuth connection and wondered whether anyone has encountered something similar.
What’s working:
ServiceM8 recognises the add-on and displays the correct OAuth permissions.
Authorisation succeeds and ServiceM8 redirects to our callback.
OAuth state verification succeeds.
Our Cloudflare Worker can reach ServiceM8’s token endpoint (HTTP 405 from an unauthenticated GET).
The token exchange URL, parameters and redirect URI have been checked against the official documentation.
The problem:
The subsequent token exchange fails before CPC can establish a connection.
We identified and corrected a Cloudflare Workers runtime issue involving redirect: "error", replacing it with redirect: "manual" and explicitly rejecting redirects. However, the live connection still fails.
Has anyone successfully implemented ServiceM8 OAuth using Cloudflare Workers?
Are there any particular requirements or known issues with the token exchange endpoint that we should be aware of?
Our Web Service Hosted Add-on model allows hosting with any cloud provider and requires OAuth 2.0 authentication.
For the initial token exchange, the required request is POST https://go.servicem8.com/oauth/access_token with these five POST parameters:
grant_type=authorization_code
client_id=<your App ID>
client_secret=<your App Secret>
code=<the code received at your OAuth callback>
redirect_uri=<the identical URI used in the authorisation request>
The redirect_uri must be identical to the value supplied during authorisation, not just share the same host. A successful exchange returns both an access_token and a refresh_token.
Since you’ve already checked those values, please email support@servicem8.com with the exact Worker exception and stack trace, the UTC timestamp of a failed attempt, a sanitised token-request code snippet showing the method, headers and body construction, and any HTTP response status and sanitised response body received. Exclude API keys, the App Secret, authorisation codes, access/refresh tokens and personal information.
We’ll need to confirm Cloudflare Workers-specific compatibility, accepted token-request body encodings and Content-Type requirements, and token-endpoint HTTP redirect handling with the team.
Thanks for getting back to me and for explaining the OAuth token exchange requirements.
Just wanted to update you that we’ve successfully resolved the Cloudflare Workers OAuth issue, and CPC by Veltrovi is now connecting and launching correctly within ServiceM8.
We subsequently encountered an unrelated authorisation issue, which turned out to be our validation not recognising the full “Default Business Owner Role” name. Once corrected, activation completed successfully.
We’re now progressing with development of the customer portal itself.
Thanks again for your help. I thought I’d update the thread in case our experience is useful to other developers.