OAuth Integration

┌──────────┐     1. Redirect      ┌─────────────────┐
│ Your App │ ──────────────────── │ auth.shellapps.com │
│          │                      │   /oauth/authorize  │
│          │     2. User logs in  │                     │
│          │                      │                     │
│          │     3. Redirect back │                     │
│          │ ◄─────────────────── │  ?code=abc123       │
│          │                      └─────────────────────┘
│          │     4. Exchange code
│          │ ──────────────────── POST /oauth/token
│          │
│          │     5. Access token
│          │ ◄─────────────────── { access_token, ... }
└──────────┘

https://auth.shellapps.com/oauth/authorize?
  client_id=your_client_id&
  redirect_uri=https://your-app.com/callback&
  response_type=code&
  scope=profile+groups&
  state=random_csrf_token

const response = await fetch('https://auth.shellapps.com/api/v1/oauth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    grant_type: 'authorization_code',
    code: 'abc123',
    client_id: 'your_client_id',
    client_secret: 'your_client_secret',
    redirect_uri: 'https://your-app.com/callback',
  }),
});
 
const { access_token, refresh_token, expires_in, scope } = await response.json();

const user = await fetch('https://auth.shellapps.com/api/v1/auth/session', {
  headers: { Authorization: `Bearer ${access_token}` },
}).then(r => r.json());

const response = await fetch('https://auth.shellapps.com/api/v1/oauth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    grant_type: 'refresh_token',
    refresh_token: 'rt_...',
    client_id: 'your_client_id',
    client_secret: 'your_client_secret',
  }),
});