Create a company with partner credentials

If you create Remote companies on behalf of your own customers, you can create the company and receive access tokens for it in a single request — no consent screen, no browser redirect.

ℹ️ Which flow do you need?
If the company already exists on Remote, you cannot use this page. Use the Authorization Code Flow instead, where a company admin signs in and approves your integration.
This page is for when you create the company and your integration is eligible for this feature. Learn more about Remote Embedded

Eligibility

This path requires the Generate tokens on company creation setting to be enabled on your integration. It is off by default.

If it is not enabled, the request fails with a message naming the action:

This integration is not allowed to use the `get_oauth_access_tokens` action.
Please use the company consent flow or contact the Remote API team.

Contact your Remote representative if you encounter this error. If this path is not open to you, use the Authorization Code Flow instead — it is available to every partner.

Create the company and get tokens

Send a POST to the company creation endpoint with the get_oauth_access_tokens action, authenticated with an access token from the Client Credentials Flow. The API documentation for this endpoint is here.

curl --location --request POST \
  'https://gateway.remote-sandbox.com/v1/companies?action=get_oauth_access_tokens' \
  --header 'Authorization: Bearer YOUR_CLIENT_CREDENTIALS_TOKEN' \
  --header 'Content-Type: application/json' \
  --data-raw '{
    "name": "My Test Co.",
    "tax_number": "123456789",
    "country_code": "CAN",
    "desired_currency": "CAD",
    "company_owner_email": "[email protected]",
    "company_owner_name": "Jane Smith",
    "terms_of_service_accepted_at": "2026-08-21T17:00:38Z",
    "scope": "employment:read timeoff:read",
    "address_details": {
      "address": "Address line 1",
      "address_line_2": "Address line 2",
      "city": "Toronto",
      "postal_code": "M5H 2N2",
      "state": "ON"
    }
  }'

A successful request returns 201 Created. For production, replace the domain with gateway.remote.com.

⚠️ terms_of_service_accepted_at must be within the last 15 minutes. Generate it at the moment you send the request. A hardcoded timestamp will fail with 400 The Terms of Service acceptance date has expired.

Check country_code against the list countries endpoint before sending.

Request only the scopes you need

The scope field controls what the returned access token can do. Pass a space-separated list, exactly as in the Authorization Code Flow. Scopes are enforced per endpoint — see Scopes for available values.

⚠️ Omitting scope grants full access. Leave it out and the token is issued with all:write — everything the company admin could do. Always set it explicitly.

Other actions

The endpoint accepts several actions, comma-separated, each gated by its own integration setting:

For example: ?action=get_oauth_access_tokens,send_create_password_email

An unrecognised action returns 422 with action_invalid and the offending value. An action your integration is not enabled for returns is not allowed. Actions are validated before the company is created, so a rejected request creates nothing.

The response

{
  "data": {
    "company": {
      "...": "the newly created company"
    },
    "tokens": {
      "access_token": "ACCESS_TOKEN",
      "refresh_token": "REFRESH_TOKEN",
      "expires_in": 3600
    }
  }
}

The company object carries the new company's details, including its status. The tokens object is the part that matters for access:

• access_token manages the new company and nothing else. It expires after expires_in seconds — 3600, one hour.
• refresh_token must be stored securely. It is how you get new access tokens once the first expires, via the Refresh Token Flow. Refresh tokens do not rotate, so the same value stays valid — treat it as a long-lived secret with the same care as your client secret.