Add SweatStack to a multi-platform app¶
A reference card for integrators adding SweatStack as one destination among many, with an existing OAuth2 code path. SweatStack is a standard OAuth2 / OpenID Connect provider; if you have a working integration with another platform, it will almost certainly work here unchanged. This page is the quick map. For the full walk-through, see OAuth2.
Four things that differ from other platforms¶
- PKCE is optional, not required. The plain Authorization Code flow with a client secret is fully supported.
- Credentials are self-service. Nobody emails you a client ID or secret; you get them from the app's settings page.
- The client secret is not created automatically. You create it in the Secrets section (not needed at all with PKCE).
- There is no approval queue. Filling the four required fields makes your app public immediately, the moment you save.
Endpoints¶
| Authorization | https://app.sweatstack.no/oauth/authorize |
| Token | https://app.sweatstack.no/api/v1/oauth/token |
| OIDC discovery | https://app.sweatstack.no/.well-known/openid-configuration |
| JWKS | https://app.sweatstack.no/.well-known/jwks.json |
If your library supports OpenID Connect discovery, point it at the discovery URL and it will configure every endpoint, scope, and signing key automatically.
Worked authorization URL (scopes are space-delimited, URL-encoded):
https://app.sweatstack.no/oauth/authorize?response_type=code&client_id={client_id}&redirect_uri={redirect_uri}&scope=data:read%20data:write
Credentials¶
- Client ID = the Application ID on the app's settings page. Public; safe to ship.
- Client secret = created by you in the Secrets section (only needed for the non-PKCE flow). Treat like a password; never ship it to a browser or device.
Create an app at Settings → API.
Scopes¶
Space-delimited (RFC 6749 §3.3); commas also accepted.
| Scope | Grants |
|---|---|
data:read |
Read access to user data. |
data:write |
Write (and delete) access. Does not grant read. Request data:read too if you need both. |
profile |
Profile information (includes email). |
offline_access |
Issues a refresh token. |
PKCE¶
Supported and recommended, not required. A flow started with a code_challenge must be
completed with its code_verifier (no downgrade to a secret); a flow started without PKCE uses
the client secret.
Redirect URIs¶
Three accepted types (RFC 8252): claimed https,
loopback http (localhost / 127.0.0.1, any port), and private-use custom schemes
(com.example.app://oauth/callback, myapp://callback — reverse-DNS not required). https and
loopback match by sub-path; custom schemes match exactly, so register the precise string your
app presents. Public plain http:// and URIs with a #fragment are rejected. Details:
accepted formats.
Tokens¶
| Token | Lifetime |
|---|---|
| Access token | 15 minutes (JWT, RS256). |
| Refresh token | Until the user revokes your app. |
On a 401, refresh and retry rather than restarting the OAuth flow. Token errors follow
RFC 6749 §5.2: a JSON body with an error
code (invalid_grant, invalid_client, invalid_request, …).
Going live¶
Your app is private (only you can connect) until you fill four fields: description, URL, image, and privacy statement. Save them and the app is public immediately — no review, no queue. Listing in the public App Directory is a separate, optional step. See Going live.