What it is
OAuth 2.0 account linking that runs entirely inside your module. A user starts linking, approves on the provider's page, and the module stores their access and refresh tokens in private tables that no client can read.
A scheduled job refreshes tokens before they expire. A withToken helper refreshes on demand and retries once on a 401, so your code can call provider APIs as that user.
Where it fits
- Use it when your app acts on a user's behalf on another service: reading someone's Twitch channel or followers, posting to Discord, or pulling their Spotify playback or GitHub repos.
- It's account linking: users keep their SpacetimeDB identity and attach other accounts to it. That suits apps whose login is already handled (for example by SpacetimeAuth) but which need third-party API access.
How it works
Mount it, pass the provider config and a secret from environment variables into oauth.configure in init, and add one HTTP route for the provider's callback.
Clients call the oauth.begin procedure to get the authorize URL, open it in a popup or redirect, and finish with oauth.complete. The oauth.my_accounts view shows each user their own linked accounts.
From your own procedures, oauth.get(ctx.as.oauth, ctx.sender, 'twitch', url) makes an authenticated request with a fresh token. Rust and C# versions share the same schema.
