Server-backed

Python integration

Generate the transaction on the server and exchange the code there.

Server-backed flow

Register an exact HTTPS callback. On the backend, generate a new random state and PKCE verifier, derive its S256 challenge, and store the transaction in a short-lived server session tied to the browser. Redirect to https://auth.bhauu.online/oauth/authorize with response_type=code and scope=profile email. At callback, validate state and exchange the code once. Include a server-held client secret only if this registered client uses one; the programming language alone does not make it confidential.

Python: begin authorization

import base64, hashlib, secrets
from urllib.parse import urlencode
from urllib.request import Request, urlopen
def b64url(data: bytes) -> str:
    return base64.urlsafe_b64encode(data).rstrip(b'=').decode('ascii')
verifier = b64url(secrets.token_bytes(32))
state = b64url(secrets.token_bytes(32))
challenge = b64url(hashlib.sha256(verifier.encode('ascii')).digest())
# Store state and verifier in a short-lived server session tied to this browser.
query = urlencode({'client_id': 'YOUR_CLIENT_ID', 'redirect_uri': 'https://example.com/auth/callback', 'response_type': 'code', 'scope': 'profile email', 'state': state, 'code_challenge': challenge, 'code_challenge_method': 'S256'})
authorize_url = 'https://auth.bhauu.online/oauth/authorize?' + query

Callback exchange

Python: callback request

import json
from urllib.parse import urlencode
from urllib.request import Request, urlopen
# At callback: compare returned state to the saved session state first.
fields = {'grant_type': 'authorization_code', 'client_id': 'YOUR_CLIENT_ID', 'code': callback_code, 'redirect_uri': 'https://example.com/auth/callback', 'code_verifier': saved_verifier}
# For a registered confidential client only: fields['client_secret'] = os.environ['BHAUU_CLIENT_SECRET']
request = Request('https://auth.bhauu.online/oauth/token', data=urlencode(fields).encode(), headers={'Content-Type': 'application/x-www-form-urlencoded'})
with urlopen(request, timeout=10) as response:
    tokens = json.load(response)  # Keep tokens server-side.

Complete application sign-in

Use the returned access token with https://auth.bhauu.online/oauth/userinfo if scoped identity claims are needed. Establish an HttpOnly, Secure, SameSite application-session cookie where suitable, with CSRF protection. Clear the pending state and do not expose tokens to templates or logs. Handle local logout and Bhauu-side revocation separately.