Skip to main content

OAuth 2.0 documentation for third-party developers

Everything you need to let people sign in to your product with their Nanako account is now documented: the flow, every endpoint and parameter, every scope and claim, every error, and the security requirements.

Added​

  • OAuth 2.0 — overview, supported client types, token lifetimes, and what the provider does and does not implement
  • Registering an application — developer approval, application creation, redirect URI rules and credential handling
  • Authorization code flow — the complete integration with runnable requests, including PKCE, refresh and revocation
  • Scopes — the four scopes, the claims each returns, and how scope is validated
  • Endpoint reference — every parameter and response field for the four OAuth endpoints
  • Errors — every error, its cause, and whether to retry
  • Security requirements — what an integration must get right

Notes​

Two limits are worth knowing before you start: the discovery document at /.well-known/openid-configuration lists endpoint URLs that do not resolve, so configure the endpoints by hand; and a browser-only application cannot complete the token exchange without an operator allowlist entry. Both are covered in the documentation.