MyNickname OAuth API Docs

Authorization Request:

Query params

1. The request with query parameters:
   GET https://api.mynickname.com/oauth/authenticate?response_type=code&client_id=[client_id]&redirect_uri=[redirect_uri]&scope=[scope]&state=[state]
2. The authorization server authenticates the user (if not already authenticated) and asks the user to authorize the client application's request for access.
3. If the user grants the request, the authorization server redirects the user back to the client's redirect_uri with the following query parameters:

   Parameter	Description
   code	Authorization code that is used in Token Request
   state	state parameter sent in the original request. You should compare this value with the value stored in the user’s session to ensure the authorization code is obtained in response to requests made by this client rather than another client application.

Token Request:

Request body params

1. The client application exchanges the authorization code for an access token by making a POST request to the authorization server's token endpoint.
2. The request includes the grant_type=authorization_code, client_id, client_secret, redirect_uri, and code.
3. The authorization server will respond with a JSON object containing the following properties:

   Parameter	Description
   token_type	With the value Bearer
   expires_in	An integer representing the TTL of the access token
   access_token	The access token for future calls on behalf of the user.
   refresh_token	The token to refresh access_token.

Accessing Protected Resources:

Endpoint to retrieve the main nickname data (the nickname under which the user is authorized):

Endpoint to retrieve data for all of the user's nicknames:

Request Headers

1. The client application uses the access token to access the user's protected resources by including it in the Authorization header of HTTP requests with the value Bearer access_token.
2. The API server will respond with a JSON object containing the nickname data.

Authorization Request:

Query params

1. The client application generates a code_verifier, a random string, and creates a code_challenge by hashing the code_verifier with SHA-256 and encoding it using URL-safe Base64 (RFC 7636). The code_challenge is sent to the authorization server, while the code_verifier is kept secret and used later during the token exchange.
2. The request with query parameters:
   GET https://api.mynickname.com/oauth/authenticate?response_type=code&client_id=[client_id]&redirect_uri=[redirect_uri]&scope=[scope]&code_challenge=[code_challenge]&state=[state]
3. The authorization server authenticates the user (if not already authenticated) and asks the user to authorize the client application's request for access.
4. If the user grants the request, the authorization server redirects the user back to the client's redirect_uri with the following query parameters:

   Parameter	Description
   code	Authorization code that is used in Token Request
   state	The state parameter sent in the original request. You should compare this value with the value stored in the user’s session to ensure the authorization code is obtained in response to requests made by this client rather than another client application.

Token Request:

Request body params

1. The client application exchanges the authorization code for an access token by making a POST request to the authorization server's token endpoint.
2. The request includes the grant_type=authorization_code, client_id, code_verifier, redirect_uri, code.
3. The authorization server will respond with a JSON object containing the following properties:

   Parameter	Description
   token_type	With the value Bearer
   expires_in	An integer representing the TTL of the access token
   access_token	The access token for future calls on behalf of the user
   refresh_token	The token to refresh access_token

Accessing Protected Resources:

Endpoint to retrieve the main nickname data (the nickname under which the user is authorized):

Endpoint to retrieve data for all of the user's nicknames:

Request Headers

1. The client application uses the access token to access the user's protected resources by including it in the Authorization header of HTTP requests with the value Bearer access_token.
2. The API server will respond with a JSON object containing the nickname data.

Refresh Token:

Request body params

1. When the access_token expires, the client can use the refresh_token to obtain a new access_token without requiring the user to re-authenticate.
2. The client makes a POST request to the token refresh endpoint with grant_type=refresh_token, refresh_token, client_id, and client_secret.