You're not wrong. You may want to give this a read, which ... • Aaron Parecki

48°F

Anders Pitman https://twitter.com/anderspitman • Jan 22
have their own custom domain for their instance, hosting an auth server. If someone wants to develop an app to talk to my service, they would have to register it with the instance of every user, which is impossible. Am I missing something? 2/2

You're not wrong.

You may want to give this a read, which addresses that exact problem: https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web

We use this a lot for the case you're talking about, where app developers have no relationship with the OAuth service the app is talking to.

Portland, Oregon, USA

Wed, Jan 22, 2020 3:18pm -08:00

1 like 1 reply
- Anil Kommareddi
Have you written a response to this? Let me know the URL:
- Aaron Parecki twitter.com/aaronpk
  
  Doesn't have to be a top level domain, just a URL. Both users and apps are identified by URLs. I do think there's value in just client IDs being URLs in some cases, demonstrated by the fact that Home Assistant picked out just that part of the spec for their OAuth API.
  
  Thu, Jan 23, 2020 12:21am +00:00 (via brid-gy.appspot.com)

Posted in /replies using quill.p3k.io