Skip to content

oauth-setup.md

Latest commit

 

History

History
44 lines (33 loc) · 1.61 KB

oauth-setup.md

File metadata and controls

44 lines (33 loc) · 1.61 KB
Raw

GitHub OAuth setup

Codeflio uses GitHub's OAuth Device Authorization Flow. A distributor must register a GitHub OAuth App, enable Device Flow in that app's settings, and provide its public client ID when building or launching Codeflio.

  1. Register an OAuth App named Codeflio in GitHub developer settings.

  2. Enable Device Flow for the app.

  3. Set a descriptive homepage URL. The callback URL is not used by device flow, but GitHub may require a syntactically valid HTTPS URL in the registration form.

  4. Provide the client ID using one of these options:

    CODEFLIO_GITHUB_CLIENT_ID=your_client_id cargo build --release

    Or, for development:

    CODEFLIO_GITHUB_CLIENT_ID=your_client_id cargo run

The build-time value is embedded as a public OAuth client identifier, not a client secret. Never embed or distribute an OAuth client secret. Codeflio requests only:

read:user user:email read:org

It requests no write scopes and does not request repo. During login, Codeflio displays the one-time code, expiration countdown, requested permissions, application name, and the official destination https://github.com/login/device.

Successful access tokens are stored under the Secret Service attributes:

service = io.github.worxbend.codeflio
account = github user ID
login   = GitHub login

Tokens are not written to preferences, SQLite, logs, or diagnostic output. Local logout deletes the Secret Service item. It does not automatically revoke authorization on GitHub; use the Manage GitHub authorization action in Settings to review or revoke it.