Ba da izini ga abokin ciniki tare da PKCE

Ai da tsarin lambar izini na ShareAI tare da S256 PKCE, tabbatar da state kuma musanya lambar a bayan-gidan aikace-aikacenka.

Duba azaman Markdown

A wannan shafin

Wannan tsarin yana haɗa asusun abokin ciniki ɗaya zuwa aikace-aikacenka. Abokin ciniki zai shiga, zaɓi asusun mutum ko na ƙungiya kuma ya amince da izinin da aka nema. Bayan-gidan aikace-aikacenka zai musanya lambar ɗan lokaci don tokens.

Kafin ka fara#

Kammala rajistar aikace-aikace. Kana buƙatar daidai adireshin dawowa da aka rajista, takardun shaida na abokin ciniki da aka riƙe a kan uwar garke, da zaman uwar garke don burauzar da ke kammala izini.

1. Ƙirƙiri buƙatar izini#

GET https://auth.shareai.now/oauth/authorize

Nemi abokin ciniki ya ba da izini ga aikace-aikacen.

URL na Asali: https://auth.shareai.now
Tantancewa: Mayar da burauza; aikace-aikacen da aka rajista

Samar da sabon mai tabbatarwa, state da nonce don kowanne yunƙuri. Ajiye su a zaman uwar garken mai amfani da ya fara. Aika ƙalubalen SHA-256, ba mai tabbatarwa ba, a mayar da burauza. Nemi kawai iyakokin da aikace-aikacenka ke buƙata.

Python

import base64
import hashlib
import secrets
import urllib.parse

verifier = secrets.token_urlsafe(48)
challenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b"=").decode()
state = secrets.token_urlsafe(32)
nonce = secrets.token_urlsafe(32)
# Store verifier, state and nonce in the user's server-side session.
params = {
    "response_type": "code",
    "client_id": "YOUR_CLIENT_ID",
    "redirect_uri": "https://app.example.com/auth/shareai/callback",
    "scope": "openid profile surcharge",
    "state": state,
    "nonce": nonce,
    "code_challenge": challenge,
    "code_challenge_method": "S256",
}
print("https://auth.shareai.now/oauth/authorize?" + urllib.parse.urlencode(params))

TypeScript

import { randomBytes, createHash } from "node:crypto";
const verifier = randomBytes(48).toString("base64url");
const state = randomBytes(32).toString("base64url");
const nonce = randomBytes(32).toString("base64url");
const challenge = createHash("sha256").update(verifier).digest("base64url");
// Save verifier, state and nonce in the initiating server-side session.
const params = new URLSearchParams({ response_type: "code", client_id: "YOUR_CLIENT_ID",
  redirect_uri: "https://app.example.com/auth/shareai/callback",
  scope: "openid profile surcharge", state, nonce,
  code_challenge: challenge, code_challenge_method: "S256" });
const authorizationUrl = `https://auth.shareai.now/oauth/authorize?${params}`;
// Redirect the browser to authorizationUrl.

2. Tabbatar da dawowar adireshi#

Idan aka ƙi izini, sarrafa kuskuren OAuth kamar yadda aka saba da sokewa. In ba haka ba, kwatanta abin da aka dawo da shi state tare da ƙimar da aka ajiye kafin amfani da lambar. Ƙi state da ba ya nan ko wanda bai dace ba. Yi amfani da state ɗin da aka ajiye sau ɗaya; kar ka karɓi URLs na dawowa da aka aika daga zaman burauza daban.

3. Musanya lambar#

POST https://auth.shareai.now/oauth/token

Musanya lambar amfani ɗaya da mai tabbatar PKCE da ya dace.

URL na Asali: https://auth.shareai.now
Tantancewa: Tantancewar abokin ciniki mai sirri

cURL

curl --fail-with-body "https://auth.shareai.now/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=authorization_code" \
  --data-urlencode "client_id=$SHAREAI_CLIENT_ID" \
  --data-urlencode "client_secret=$SHAREAI_CLIENT_SECRET" \
  --data-urlencode "code=$AUTHORIZATION_CODE" \
  --data-urlencode "redirect_uri=https://app.example.com/auth/shareai/callback" \
  --data-urlencode "code_verifier=$PKCE_VERIFIER"

Yi amfani da hanyar tantance abokin ciniki da aka saita don abokin ciniki. Misalin yana amfani da tantancewar abokin ciniki ta hanyar fom. Kada ka aika lambar iri ɗaya sau biyu; fara izini daga farko bayan lambar da aka yi amfani da ita ko ta ƙare.

4. Ajiye sakamakon kuma kafa zaman aikace-aikacenka#

Ajiye tokens na shiga da sabunta a bayan-gidanka. Yi amfani da abin da aka dawo da shi expires_in maimakon ɗaukar token ɗin dindindin. Idan kana amfani da ID token, tabbatar da sa hannunsa tare da JWKS na mai bayarwa, mai bayarwa da ake tsammani, masu sauraro na abokin ciniki, ƙarewa da nonce ɗinka na asali kafin amincewa da da'awar.

Ci gaba da tsarin rayuwa#

Sabuntawa da juyawa · Iyakoki da asalin asusun · Buƙatun tattaunawar OAuth

An sabunta karshe ranar 15 ga Satumba, 2026