Understanding OAuth 2.0 Security for Procore Integrations

When you connect ProBidCore to your Procore account, you never share your Procore username or password with us. Instead, ProBidCore uses the OAuth 2.0 Authorization Code Grant flow — the same security standard used by Google, Microsoft, and every serious SaaS integration.

Here's how it works: When you click 'Log in with Procore', you're redirected to Procore's own login page. You enter your credentials directly on Procore's site, and Procore asks you to authorize ProBidCore to access specific data — budgets and projects. ProBidCore never sees your password.

After you authorize, Procore sends ProBidCore a temporary authorization code. ProBidCore exchanges this for an access token and a refresh token. The access token is used to make API calls on your behalf, and it expires every 2 hours. The refresh token lets ProBidCore get a new access token without asking you to log in again.

ProBidCore requests only the minimum scopes needed: budgets:read (to check budget lock status), budgets:write (to push line items), and projects:read (to list your projects). We don't request access to your RFIs, submittals, daily logs, or any other Procore data.

OAuth state parameters are cryptographically signed using HMAC-SHA256 to prevent cross-site request forgery (CSRF) attacks. All communication happens over HTTPS/TLS. You can revoke ProBidCore's access at any time from your Procore account settings or from the ProBidCore Settings page.