Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: clarifications in README.md #289

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

docs: clarifications in README.md #289

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 7 additions & 8 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,14 +61,13 @@ You can use that code as inspiration or just fork and play with it. The account-
module is used for authenticating the user with Schibsted account. Take a look at how the SDK is
initialized.

When a user wants to log in to your site, you direct them to a UI flow that is hosted by Schibsted
Account. We authenticate the user and redirect them back to your site. This final redirect back to
your site is done in accordance with the OAuth2 spec. That means that we pass a `code` in the query
string in that redirect uri. You can use that `code` on your site backend along with your client
credentials (client id & secret) to get an *Access Token* (AT) and *Refresh Token* (RT). You don't
send the AT (and never ever the RT!) to the browser but rather keep it on the server side and
associate it with that particular user session in order to be able to call Schibsted account APIs on
behalf of that user.
When a user wants to log in to your site, you direct them to a UI flow hosted by **Schibsted Account**.
We authenticate the user and redirect them back to your site. This final redirect back to your site is performed in accordance with the OAuth2 specification.
This means we pass a `code` in the query string of that redirect URI.
You can use that `code` on your site's backend, along with your client credentials (client ID and secret), to obtain an *Access Token* (AT) and a *Refresh Token* (RT).
You should not send the AT (and **never** the RT!) to the browser. Instead, keep them on the server side and associate them with the specific user session.
This allows you to call Schibsted Account APIs on behalf of that user.


## Events

Expand Down