OAuth2: Beyond The Specs
summary
Pipedrive describes migrating hundreds of integrations from API keys to OAuth, building an API-token exchange endpoint to convert old tokens and avoiding one-use refresh tokens after developer breakage; the auth code flow uses server-to-server token exchange and bearer headers as usual. Operational details include implementing webhook creation and deletion to stop wasted calls and an uninstall webhook to revoke access, plus using the state parameter to block CSRF attacks by tying auth codes to client sessions.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:33What is OAuth2
- 5:28API tokens vs OAuth2
- 6:57Authorization code flow
- 9:30How OAuth2 calls work
- 14:58Refresh tokens pitfalls
- 17:09API token migration
- 18:14Token revocation
- 21:17Webhooks in OAuth2
- 25:43Cross-site request forgery
- 30:26Q&A
