What is OAuth?
The HamCQ community provides an OAuth-based authentication method, allowing users to obtain member information from web pages opened within HamCQ, thereby eliminating the need for login.
The design of OAuth2 is based on allowing users to grant third-party services access to their resources without revealing their account credentials.
Why provide OAuth?
Thanks to the development of the community, more and more users are using it for discussions, exchanging cards, and authentication. We commonly use QQ, WeChat, and Taobao, which also provide OAuth authorization login capabilities for third-party applications. This is an open standard and the most popular authorization mechanism currently.
Providing OAtuth will primarily offer the following benefits:
- Saves third-party developers time and eliminates registration processes, enabling quick implementation of business logic.
- Fully leverage community responsibilities to create more interesting features.
To standardize the process and protect user rights, currently, the community OAuth only provides website access, authorization\_code, and allows for displaying authorization.
How to apply
The overall OAuth2.0 processing workflow for the HamCQ community is as follows:
Step 1: Apply for access and obtain `client_id` and `client_secret`.
Step 2: Develop the application and set up collaborator accounts for testing integration.
Step 3: Place the HamCQ community login button.
Step 4: Obtain an Access Token through user login verification and authorization.
Step 5: Obtain the user's ID using an Access Token;
Step 6: Call the OpenAPI to request access to resources authorized by the user.
Send the following message to: emin@hamcq.cn We will conduct a review of developer information and website status:
1. Site Name
2. Link to the site's homepage
3. Business scenario (at least 50 characters)
4. Site Logo (at least 64x64 PX)
5. Site introduction (no more than 10 characters)
6. Domain callback address (must match exactly)
7. Domain ICP registration information, Public Security registration information
8. Website contact person information (name, mobile phone number, ID card number)
Once approved, specific information will be sent to you via email.
Interface
Authorization
/oauth/authorize
| Parameters | Instructions | Required | Default values | Example |
|---|
| client_id | Application ID | Yes | None | |
| response_type | License type | Yes | None | code or token |
| redirect_uri | Redirection URI | Yes | Application callback address | https://example.com/oauth/callback |
| scope | Permissions | No | None | user.read |
| state | Status | No | None | state |
Example:
GET https://example.com/oauth/authorize?client_id=123456&response_type = code&redirect_uri = https://user.example.com/oauth/callback&scope = user.read&state = 123456
Token
/oauth/token
| Parameters | Instructions | Required | Default values | Example |
|---|
| client_id | Application ID | Yes | None | 123456 |
| client_secret | Application key | Yes | None | 123456 |
| grant_type | License type | Yes | None | authorization code or refresh token |
| code | Authorization code | When the authorization type is "authorization\_code", this field is required. | None | 123456 |
| refresh_token | Refresh token | The `refresh_token` type requires a value. | None | 123456 |
| redirect_uri | Redirection URI | When the authorization type is "authorization\_code", this field is required. | Application callback address | https://example.com/oauth/callback |
Example:
POST https://example.com/oauth/token
Payload: client_id=123456&client_secret = 123456&grant_type=authorization_code&code = 123456&redirect_uri = https://example.com/oauth/callback
Resources (users)
/api/user
| Parameters | Instructions | Required | Default values | Example |
|---|
| access_token | Access token | Yes | None | 123456 |
Example:
GET https://example.com/api/user?access_token=123456
Retrieve user information
{
"id": 1,
"username": "BG5UWQ",
"avatar_url": "",
"email": "",
"is_email_confirmed": 1,
...
}
闽ICP备2021006864号-7
闽公网安备35020602002794号