gamesdk-and-dispatch icon indicating copy to clipboard operation
gamesdk-and-dispatch copied to clipboard

[Feature Request] applicationManager.GetOAuth2Token should allow for different scopes.

Open Jump-Suit opened this issue 5 years ago • 2 comments

In https://discord.com/developers/docs/game-sdk/applications#getoauth2token The function does not expose a parameter to add desired scopes to it, instead we are stuck with just the 'identify' scope statically put there.
As a Discord Game Dev, it would streamline the code for us to allow to edit scopes in the GameSDK OAuth2 code flow so it can be close as that of a custom OAuth2 Flow as possible, but simplified!

Jump-Suit avatar May 29 '20 01:05 Jump-Suit

The only serious issue/blocker for this is that the getOAuth2Token function just pulls from the env var Discord injects into games launched via the Library, which is limited in scope for a reason [security, not giving too much info up in case malware steals env vars, etc].

Your best bet for getting more scopes is to:

  • have the user log in to your website via Discord (once, since you can store refresh tokens)
  • when your game starts up, send the GetOAuth2Token-provided token to your own web server
    • use the users/@me endpoint to obtain the user's ID
    • cross-reference that with your database to locate your refresh token and call differently-scoped APIs.

judge2020 avatar Aug 19 '20 03:08 judge2020

My game is almost never started from Discord, so when the oauth token is missing there is a user prompt invoked in Discord to accept it, in the same way as a browser would prompt.

Doesn't that mean that the SDK is doing a bit more than just fetching an ENV var, and has to instead create some kind of oauth URL for Discord?

If thats the case, then perhaps Discord actually already supports scopes in the same way that the URL method does. Add scopes as an option to GetOAuth2Token, and if a scopes argument is provided then force an oauth prompt in the Discord - it'll then be the application's responsibility to retain the token for later instead of the presence of the environment variable, and the function would still work as current if the scopes argument isn't present.

3vcloud avatar Oct 08 '20 22:10 3vcloud