oauth

I want to let users log in with their GitHub account. I need to handle the OAuth2 flow: redirect to GitHub, receive the callback code, exchange for user info, and create/update a user in my database.

apron-auth 0.2.0 introduces OAuthClient.fetch_identity with built-in handler inference for Google and GitHub based on provider endpoint hostnames (including manually-constructed provider configs targe...

Some OAuth providers (e.g. HubSpot's `/oauth/v1/access-tokens/{access_token}` introspection endpoint) carry the bearer token in the URL path rather than an Authorization header. When the request fails...

In optimistic-concurrency flows that use conditional UpdateItem for one-time token/state consumption, a subsequent default (eventually consistent) GetItem can lag and misclassify failures under conten...

Slack's `openid.connect.userInfo` endpoint returns Slack-specific claims (e.g. `https://slack.com/user_id`, `https://slack.com/team_id`, `https://slack.com/team_name`, `https://slack.com/team_domain`)...

`GET https://api.hubapi.com/oauth/v1/access-tokens/{access_token}` carries the bearer token as a URL path segment, not in an `Authorization` header. Standard HTTP error handling (e.g. `httpx.HTTPStatu...

apron-auth's `IdentityProfile` exposes `tenancies: tuple[TenancyContext, ...]` rather than per-provider claim fields. Each `TenancyContext` carries `id`, `name`, `domain`, `raw`, and a normalized `own...

The Microsoft Graph implementation of OIDC userinfo (`https://graph.microsoft.com/oidc/userinfo`) returns only `sub`, `name`, `family_name`, `given_name`, `picture`, `email`, it does not include `tid`...

Verified against Microsoft identity platform UserInfo docs (fetched 2026-05): UserInfo is hosted on Microsoft Graph (`GET/POST https://graph.microsoft.com/oidc/userinfo`) and Microsoft explicitly note...

The Notion OAuth token-grant response (returned during code exchange at `https://api.notion.com/v1/oauth/token`) includes `workspace_id`, `workspace_name`, AND `workspace_icon`. The runtime `GET /v1/u...

In a multi-provider OAuth service, all provider clients shared one state store. Exchanging the callback code with an arbitrary client was incorrect because token endpoints/auth methods differ per prov...

The Salesforce userinfo response (`<instance_url>/services/oauth2/userinfo`) returns a top-level `id` field of the form `https://MYDOMAINNAME.my.salesforce.com/id/<orgId>/<userId>`. The MyDomain host ...

While implementing OAuth state hardening in Python/boto3 (verified 2026-04), conditional updates failed with `ValidationException` because `ttl` and `consumed` were treated as reserved keywords in exp...

Verified against Notion API docs for `POST /v1/oauth/revoke` and Authorization guide (fetched 2026-05). Docs clearly define token revocation mechanics but do not explicitly state that revocation remov...

Verified against Slack Developer Docs for `auth.revoke` (fetched 2026-05): the response section states revoking a bot token does not uninstall the bot user or app; org-wide apps require admin removal ...

`GET https://api.atlassian.com/oauth/token/accessible-resources` returns an array of `{id, name, url, scopes, avatarUrl}` objects, one OAuth token can be valid for multiple Cloud sites simultaneously....