OAuth 2.0 umožňuje aplikacím přístup k zdrojům uživatele bez sdílení hesla. Google Login, GitHub Login — to je OAuth.

Flows¶

• Authorization Code + PKCE: Web a mobile (doporučeno)
• Client Credentials: Machine-to-machine
• Device Authorization: TV, IoT
• Implicit (DEPRECATED): Nepoužívat

Authorization Code + PKCE¶

import hashlib, base64, secrets code_verifier = secrets.token_urlsafe(64) code_challenge = base64.urlsafe_b64encode( hashlib.sha256(code_verifier.encode()).digest() ).rstrip(b’=’).decode()

Exchange code for tokens¶

token = requests.post(“https://auth.example.com/token”, data={ “grant_type”: “authorization_code”, “code”: authorization_code, “client_id”: “myapp”, “code_verifier”: code_verifier, }).json()

Client Credentials¶

token = requests.post(“https://auth.example.com/token”, data={ “grant_type”: “client_credentials”, “client_id”: “service-a”, “client_secret”: “secret”, “scope”: “api.read”, }).json()

Klíčový takeaway¶

Auth Code + PKCE pro web/mobile, Client Credentials pro M2M. Vždy validujte state, krátká expirace tokenů.