misskey
misskey copied to clipboard
enhance(api): OAuth bearer token authentication
What
- Allow OAuth 2.0 Bearer Token Authentication according to RFC 6750 § 2.1 to be used alternatively to the body parameter
i. - Adjust the client to use this new method, also for GET requests.
- Handle authentication errors in the streaming API properly.
- Adjust the generated OpenAPI specification to document GET requests and the new authentication method.
- Also properly document that authentication is possible for all API endpoints, even if it is not required. Authenticating on such an endpoint may provide more data.
Why
Towards implementing OAuth 2.0 (https://github.com/misskey-dev/misskey/issues/8262), but does not solve the issue yet.
Additional info
Using both authentication methods at the same time is not allowed:
Clients MUST NOT use more than one method to transmit the token in each request. -- https://datatracker.ietf.org/doc/html/rfc6750#section-2