OAuth 2.0 — Complete Authorization Framework Guide

import requests
import secrets
import hashlib
import base64

class OAuth2Client:
    def __init__(self, client_id, client_secret, redirect_uri, token_url):
        self.client_id = client_id
        self.client_secret = client_secret
        self.redirect_uri = redirect_uri
        self.token_url = token_url

    def generate_pkce_pair(self):
        code_verifier = secrets.token_urlsafe(64)
        code_challenge = base64.urlsafe_b64encode(
            hashlib.sha256(code_verifier.encode()).digest()
        ).rstrip("=").decode()
        return code_verifier, code_challenge

    def get_authorization_url(self, auth_url, scope="openid profile"):
        _, code_challenge = self.generate_pkce_pair()
        params = {
            "response_type": "code",
            "client_id": self.client_id,
            "redirect_uri": self.redirect_uri,
            "scope": scope,
            "code_challenge": code_challenge,
            "code_challenge_method": "S256",
            "state": secrets.token_urlsafe(16),
        }
        url = f"{auth_url}?{'&'.join(f'{k}={v}' for k, v in params.items())}"
        print(f"[OAuth2] Authorization URL generated")
        return url

    def exchange_code(self, code, code_verifier):
        data = {
            "grant_type": "authorization_code",
            "code": code,
            "redirect_uri": self.redirect_uri,
            "client_id": self.client_id,
            "client_secret": self.client_secret,
            "code_verifier": code_verifier,
        }
        response = requests.post(self.token_url, data=data, timeout=10)
        response.raise_for_status()
        tokens = response.json()
        print(f"[OAuth2] Access token received: {tokens.get('access_token', '')[:20]}...")
        return tokens

    def refresh_access_token(self, refresh_token):
        data = {
            "grant_type": "refresh_token",
            "refresh_token": refresh_token,
            "client_id": self.client_id,
            "client_secret": self.client_secret,
        }
        response = requests.post(self.token_url, data=data, timeout=10)
        if response.status_code == 200:
            return response.json()
        return None

// Service-to-service OAuth 2.0
const axios = require("axios");

async function getClientCredentialsToken() {
  const response = await axios.post("https://auth.example.com/token", {
    grant_type: "client_credentials",
    client_id: process.env.CLIENT_ID,
    client_secret: process.env.CLIENT_SECRET,
    scope: "api:read api:write",
  }, {
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
  });

  const { access_token, expires_in } = response.data;
  console.log(`Service token: ${access_token.substring(0, 20)}...`);
  console.log(`Expires in: ${expires_in}s`);

  return access_token;
}

async function callProtectedAPI() {
  const token = await getClientCredentialsToken();
  const result = await axios.get("https://api.example.com/orders", {
    headers: { Authorization: `Bearer ${token}` },
  });
  return result.data;
}

import os
import json
import requests
import secrets
import hashlib
import base64
from pathlib import Path

class OAuth2CLI:
    def __init__(self, config_path=".oauth_config.json"):
        self.config_path = Path(config_path)
        self.token_path = Path(".oauth_token.json")
        self.config = self._load_config()

    def _load_config(self):
        if self.config_path.exists():
            return json.loads(self.config_path.read_text())
        return {}

    def configure(self, client_id, auth_url, token_url, redirect_uri):
        config = {
            "client_id": client_id,
            "auth_url": auth_url,
            "token_url": token_url,
            "redirect_uri": redirect_uri,
        }
        self.config_path.write_text(json.dumps(config, indent=2))
        print(f"Configuration saved to {self.config_path}")

    def login(self):
        if not self.config:
            print("Run configure first")
            return
        verifier = secrets.token_urlsafe(64)
        challenge = base64.urlsafe_b64encode(
            hashlib.sha256(verifier.encode()).digest()
        ).rstrip("=").decode()
        auth_url = f"{self.config['auth_url']}?response_type=code&client_id={self.config['client_id']}&redirect_uri={self.config['redirect_uri']}&code_challenge={challenge}&code_challenge_method=S256&state={secrets.token_urlsafe(16)}"
        print(f"Open in browser:\n{auth_url}\n")
        code = input("Paste authorization code: ").strip()
        response = requests.post(self.config["token_url"], data={
            "grant_type": "authorization_code",
            "code": code,
            "redirect_uri": self.config["redirect_uri"],
            "client_id": self.config["client_id"],
            "code_verifier": verifier,
        })
        tokens = response.json()
        self.token_path.write_text(json.dumps(tokens, indent=2))
        print("Token stored")

    def get_token(self):
        tokens = json.loads(self.token_path.read_text())
        return tokens.get("access_token")