OAuth for user devices

Use this path when the end user owns the Imou Life devices. Your developer account does not bind those cameras. Concept and console screenshots: OAuth 2.0 authorization. APIs: OAuth authorization.

The overseas Open Platform does not offer device hosting: end users cannot host devices from their app onto your developer account. Source: Devices.

Authorization → token → getStreamUrl

Create an OAuth project on the Open Platform. Keep the Project Access Key / Secret Key on your server.
Send the end user to the platform authorization H5. After they confirm, the platform posts code to your callback URL.
Exchange the code with oauthTokenV2: POST /openapi/oauthTokenV2, Basic Authorization of AK:SK, grant_type=authorization_code, same redirect_uri as the project. Success returns access_token (bearer), expires_in 7200 seconds, refresh_token, and scope all.
Refresh before expiry with the same method, grant_type=refresh_token. The user does not open the H5 again.
For RTSP, call getStreamUrl with the project AK/SK and the user access token. Identify the camera by serial number, channel, and stream type (0 main, 1 sub).

Other device and message OAuth methods stay on OAuth authorization. Do not integrate the unpublished things-model OpenAPI (getProductModel, iotDeviceControl). See Device capabilities & events.

Compare with the sub-account model

	Sub-account	OAuth user devices
Who owns the device	Your developer account after bindDevice	The Imou Life end user
Credential you mint	subAccountToken (`St_`)	`oauthTokenV2` user `access_token` (`Ot_` in the concept page)
Typical play	OpenSDK or ImouPlayer with your bound devices	getStreamUrl RTSP
Setup guide	Set up a sub-account	This page

Do not mix the two models on the same camera.

Authorization is valid 90 days on the concept page. Profile changes and deleting an authorization are handled in the current console and OAuth APIs, not in this onboarding flow.