Document OAuth2 partner authentication and authToken usage - #63
Open
marcaaron wants to merge 5 commits into
Open
Document OAuth2 partner authentication and authToken usage#63marcaaron wants to merge 5 commits into
marcaaron wants to merge 5 commits into
Conversation
Add a new section to the Authentication docs covering the full OAuth2 authorization code flow, including how to exchange a code for tokens, use the access_token as credentials.authToken in IS requests, and refresh tokens when they expire. Replace a dead link to oauth_partner_guide.html with this inline content. Also update nokogiri to >= 1.11.0 and .ruby-version to 2.7.8 so the docs build on Apple Silicon.
|
|
||
| To act on behalf of individual Expensify users, use the OAuth2 authorization code flow to obtain a short-lived access token. Pass that token as `credentials.authToken` in your requests. | ||
|
|
||
| **Access:** OAuth2 partner authentication is currently in private beta. To request access, contact [concierge@expensify.com](mailto:concierge@expensify.com). |
There was a problem hiding this comment.
Suggested change
| **Access:** OAuth2 partner authentication is currently in private beta. To request access, contact [concierge@expensify.com](mailto:concierge@expensify.com). | |
| **Access:** OAuth2 partner authentication is currently in private beta. To request access, contact [partners@expensify.com](mailto:partners@expensify.com). |
@NickTooker while we have this in private beta, I think we have any kenny keano email partners@ instead of Conci. You cool with that?
| Keep your <code>client_secret</code> on the server only. Never expose it in client-side code, browser requests, or mobile apps. Any code a user can read or intercept must not contain it. | ||
| </aside> | ||
|
|
||
| **Client secret:** Your `client_secret` is only shown once when first generated. If you lose it, go to <https://www.expensify.com/tools/integrations/> and click **"Generate new client secret."** This immediately invalidates your old secret — update all systems using it before regenerating. |
There was a problem hiding this comment.
Suggested change
| **Client secret:** Your `client_secret` is only shown once when first generated. If you lose it, go to <https://www.expensify.com/tools/integrations/> and click **"Generate new client secret."** This immediately invalidates your old secret — update all systems using it before regenerating. | |
| **Client secret:** Your `client_secret` is only shown once when first generated. If you lose it, go to <https://www.expensify.com/tools/integrations/partners> and click **"Generate new client secret."** This immediately invalidates your old secret — update all systems using it before regenerating. |
Isn't this URL missing /partners else it goes to the page that exists now for the existing authentication method?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Make sure you've checked off all these things before submitting:
devbranch.Summary
Linked issue: https://github.com/Expensify/Expensify/issues/662652
Adds a new OAuth2 partner authentication section to the Authentication docs, covering:
access_tokenascredentials.authTokenin Integration Server requestsAlso replaces a dead link to
oauth_partner_guide.html(404 since the page never existed) with a reference to the new inline section.Additionally updates
nokogirito>= 1.11.0and.ruby-versionto2.7.8so the docs build cleanly on Apple Silicon (arm64).