Files
zkldi_Tachi/old-docs/docs/api/routes/oauth2.md
T
zk e363bd2532 docs: migrate from mkdocs to mdbook (#1558)
* docs: migrate from mkdocs to mdbook

- Rename old mkdocs docs/ to old-docs/ for reference
- Set up new docs/ with mdbook (book.toml + src/ tree)
- Mirror full nav structure from mkdocs.yml into SUMMARY.md
- Add Justfile-docs with docs-serve, docs-build, docs-check, docs-install recipes
- Import Justfile-docs from root Justfile
- Rewrite .github/workflows/docs.yml: build step uses taiki-e/install-action
  to install mdbook, split into separate build + deploy jobs, PR builds
  run the check step too

* ci(docs): pin actions to SHAs, install mdbook via release binary

* ci(docs): install mdbook from apt instead of curling a release binary

* dev: replace mkdocs python stack with mdbook in dev image

* ci(docs): apt only works on Debian; restore release binary install for Ubuntu CI

* docs: fix duplicate file entries in SUMMARY.md

* docs: remove docs-install recipe

* docs: remove site-url from book.toml to fix asset loading

* dev: install mdbook from upstream release binary, not Debian apt

The Debian package (0.4.x+ds) strips bundled font assets, leaving the
built site without fonts/fonts.css. Use the upstream tarball (same as CI)
so the theme is complete. Handles x86_64 and aarch64.

* docs: vendor mdbook tarballs in dev/mdbook/, install from there

Dockerfile.dev uses COPY + tar to install the right arch at build time.
CI extracts the x86_64 tarball directly from the checkout.
No network access required for either — and no stripped-fonts Debian package.

* fix: unwritten
2026-05-22 20:43:07 +01:00

102 lines
2.1 KiB
Markdown

# OAuth2 Integration
Tachi provides an OAuth2 API and some other things
so that you can create your own clients and retrieve
user api keys safely.
For a detailed explaination on how to use the OAuth2 flow, you can check [Using OAuth2 With Tachi](../../codebase/infrastructure/oauth2.md)
*****
## Convert Auth Code to API Key
`POST /api/v1/oauth/token`
### Parameters
| Property | Type | Description |
| :: | :: | :: |
| `client_id` | String | Your clients ID. |
| `client_secret` | String | Your clients secret. |
| `grant_type` | "authorization_code" | This is the only form of grant_type we currently support. |
| `redirect_uri` | String | The redirect URI your client uses. This must match the one in your client. |
| `code` | String | The intermediate auth code to convert up into an API Key. |
### Response
| Property | Type | Description |
| :: | :: | :: |
| `<body>` | APIKeyDocument | The APIKeyDocument created for your service to use. |
### Example
#### Request
```
POST /api/v1/oauth/token
---
{
"client_id": "my_client_id",
"client_secret": "some_secret_value!",
"grant_type": "authorization_code",
"redirect_uri": "https://example.com/callback",
"code": "intermediate_code"
}
```
#### Response
```json
{
"userID": 1,
"token": "fdbufasbfuarf",
"identifier": "Your_Service Token",
"permissions": {
"customise_profile": true
},
"fromAPIClient": "my_client_id"
}
```
*****
## Create an intermediate Code
`POST /api/v1/create-code`
!!! info
This infers the current user from the session cookie.
This is *not* meant to be called by external code, and
is instead something for `tachi-client` to use on the oauth confirmation screen.
### Parameters
None.
### Response
| Property | Type | Description |
| :: | :: | :: |
| `code` | String | The intermediate code. |
| `userID` | Integer | The user this code belongs to. |
| `createdOn` | Number | The time in unix milliseconds that this code was created. |
!!! warning
These codes expire around 30 minutes from their creation.
### Example
#### Request
```
POST /api/v1/oauth/create-code
```
#### Response
```json
{
"code": "foobarbarhsdufh",
"userID": 1,
"createdAt": 111111111111
}
```