point you towards using the vwnd/speckle-auth package, but that package doesnt actually use PKCE as far as i can tell, because the calls to swop the auth code for a token passes the client secret as part of its call.
The section about doing it manually just tells you to swop the auth code for a token, but doesnt tell you how.
Is there any documentation that tells us what the REST API endpoints are for doing the PKCE worklflow, and the data you need to provide in each call?
In that case, the Speckle team need to update the documentation because they talk about using PKCE, and are pointing and highly recommending to use a package that doesn’t actually do PKCE login.
If it is the same endpoint URLs used for PKCE, where and how do I provide the code challenge and code challenge method in the first call? In the url path? As parameters?
How do I provide the verifier code in the second call? Assuming it’s a POST request, is there a sample of what the body should look like?
The package does PKCE but from your messages, I understand you probably has seen other flavours of PKCE. Speckle uses a simpler one, for the better or worse.
Our use case here is for a vue3 application running on a users machine, so we cant have the client secret stored on the users machine to include in line 168 on the second screenshot above.
Is there a Speckle endpoint for exchanging the auth code for a token that does not require the client secret to be included?
If not, i guess the only option is i need to create my own API endpoint which the first stage can redirect back to. have this API exchange the auto code for a token, then get it to return the token to the user.
I was really hoping the PKCE that had been implemented on Speckle included the option not to require the client secret so i avoided having to create this extra API
but from your messages, I understand you probably has seen other flavours of PKCE. Speckle uses a simpler one, for the better or worse.