OAuth2 authentication

[dadapapa]

Hi,
I am trying to write a little OGS Notifier for the GNOME3 desktop environment. I try to authenticate to the site following the documentation on https://ogs.docs.apiary.io/#reference/authentication/request-a-user-token. Unfortunately, I am not successful in accessing the OAuth2 user token when providing my client-id and client-secret. Although my original code is in GJS, this simple wget line demonstrates the issue:

$ wget --post-data=‘client_id=ScRamblEdcLiEnTiD&client_secret=sCraMBLedCliENtsEcReT’ https://online-go.com/oauth2/access_token
–2019-10-01 11:28:18-- https://online-go.com/oauth2/access_token
HTTP request sent, awaiting response… 404 Not Found
2019-10-01 11:28:18 ERROR 404: Not Found.

Am I doing something wrong in the request or is the documentation not up to date any longer? What is the recommended way for an application to authenticate against OGS?

Thanks! harold

[flovo]

@dadapapa

client_secret=sCraMBLedCliENtsEcReT

I don’t think it’s a great deal in this case, but don’t post anything that has secret in its name anywhere
Best to XXX all credentials you are using next time. The values aren’t the problem in most cases anyways.

This should work:

Apiary Documents Out of Date?

Yes, the API doc is out of date. To get an oauth2 token you can follow How can I get an oauth2 token? curl -X POST -d 'grant_type=password&username=${username}&password=${password}&client_id=${client_id}&client_secret=${client_secret}' https://online-go.com/oauth2/token/ If you already have a token and it expired, you can get a new one with curl -X POST -d 'grant_type=refresh_token&username=${username}&refresh_token=${refresh_token}&client_id=${client_id}&client_secret=${client_secret}' http…

You have to add the user credentials.

[Kosh]

@flovo

but don’t post anything that has secret in its name anywhere

Sorry, can’t resist:

Click here

[dadapapa]

Thank you for the quick answer, flovo! I will follow the recipe that you provide. I did not expect to need the user credentials (username, password) along with the client credentials (id, secret), though. Always learn something new.
Btw. If you look at the client_secret I posted, you will see that I had XXX’ed it, just in a slightly more subtle way
cheers.