Expand description
OAuth 2.0 with PKCE, as Lichess does it: no client registration (the
client_id is any name the app picks), S256 code challenges, and
long-lived access tokens.
The person approving is whoever is signed in to this server in this
browser (its own accounts, or the host site’s: crate::http::web);
anyone else is sent to sign in first. Tokens issued here are listed and
revocable on the Account page.
Functions§
- authorize
GET /oauth: the consent page.- decide
POST /oauth: the consent decision.- page
- The server’s own HTML pages (sign-in, account, consent), in the Chess lab’s dark colours with the open-chess logo.
- revoke
DELETE /api/token: revoke the token used for this request.- test
POST /api/token/test: which of these tokens work (comma-separated body, up to 1000).- token
POST /api/token: trade a code (and its PKCE verifier) for a token.