undefined | Better HN

0 pointsjkubicek3y ago0 comments

Your documentation is amongst the best I've seen on OAuth, but it suffers from the same naming confusion I always run into when I'm reading OAuth docs.

> OAuth 2 makes it easy for large service providers to write many APIs that users can securely authorize third party consumers

If I'm trying to write a Mastodon client, I'm reading this line piece by piece:

> OAuth 2 makes it easy for large service providers

"service providers" OK, that must be the Mastodon service.

> ... to write many APIs that users

"users" That must be me

> ... can securely authorize third party consumers

"consumers" OK... that's also me?

0 comments

4 comments · 4 top-level

btilly3y ago

That is why there is a terminology section: https://metacpan.org/dist/LWP-Authen-OAuth2/view/lib/LWP/Aut...

If you're trying to write a Mastadon client, then the Mastadon service is the service provider, you are the consumer, and the people who wish to use your client are the users.

mekoka3y ago

I think it's helpful to not stray too far away from the standard terminology. I found that "third party" was an excellent indicator that the consumer is probably not me, especially since I've already qualified as a user.

Operyl3y ago

Users are your users shared with the users of that API service (which may include you if you use your own service), consumer in this case is you (the application you're running).

pcthrowaway3y ago

Read the introduction again, and then follow the link to the Terminology section.

j / k navigate · click thread line to collapse