Idhinisha akaunti kwa PKCE
Tumia msimbo wa idhini pamoja na S256 PKCE kwa programu za siri na za umma.
- Tengeneza hali ya nasibu ya kriptografia na PKCE verifier mpya kwa kila idhini. Hesabu changamoto ya S256.
- Elekeza kwenye endpoint ya idhini na client_id, redirect_uri halisi, response_type=code, scope, state, code_challenge na code_challenge_method=S256.
- Mteja huingia, huchagua akaunti yao binafsi au ya shirika, hupitia scopes na hukubali mpango wowote wa malipo.
- Thibitisha hali kwenye callback yako. Badilisha msimbo mara moja, ukitumia redirect URI ya awali na code_verifier.
- Hifadhi tokeni kwa usalama. Tumia subject iliyorejeshwa inayohusiana na mteja kama kitambulisho cha mteja.
POST
https://auth.shareai.now/oauth/token- URL ya Msingi
https://auth.shareai.now- Uthibitishaji
- Public client ID + PKCE, au uthibitishaji wa confidential client + PKCE
cURL
curl --fail-with-body 'https://auth.shareai.now/oauth/token' --data-urlencode 'grant_type=authorization_code' --data-urlencode "client_id=$SHAREAI_CLIENT_ID" --data-urlencode "code=$AUTHORIZATION_CODE" --data-urlencode 'redirect_uri=https://your-app.example/callback' --data-urlencode "code_verifier=$PKCE_VERIFIER"
Mfano huu ni wa public client. Usiongeze siri au sifa za HTTP Basic. Confidential client inathibitisha kwa kutumia sifa zake za server-side client pamoja na PKCE. Kamwe usisambaze siri ya confidential kwenye kivinjari, desktop, simu au usambazaji wa kujihost.
Ugunduzi: https://auth.shareai.now/.well-known/openid-configuration. Tumia endpoints zilizotangazwa na funguo za kusaini. Kataa hali zisizolingana, watoleaji wasiotarajiwa na ID-token audience au saini isiyo sahihi.
Viwango: Mazoezi bora ya usalama ya OAuth na PKCE. Tokeni za kuburudisha.
Ilisasishwa mwisho Septemba 18, 2026