{
  "schemaVersion": "1.0",
  "item": {
    "slug": "oauth",
    "name": "OAuth",
    "source": "tencent",
    "type": "skill",
    "category": "其他",
    "sourceUrl": "https://clawhub.ai/ivangdavila/oauth",
    "canonicalUrl": "https://clawhub.ai/ivangdavila/oauth",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadMode": "redirect",
    "downloadUrl": "/downloads/oauth",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=oauth",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "installMethod": "Manual import",
    "extraction": "Extract archive",
    "prerequisites": [
      "OpenClaw"
    ],
    "packageFormat": "ZIP package",
    "includedAssets": [
      "SKILL.md"
    ],
    "primaryDoc": "SKILL.md",
    "quickSetup": [
      "Download the package from Yavira.",
      "Extract the archive and review SKILL.md first.",
      "Import or place the package into your OpenClaw setup."
    ],
    "agentAssist": {
      "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
      "steps": [
        "Download the package from Yavira.",
        "Extract it into a folder your agent can access.",
        "Paste one of the prompts below and point your agent at the extracted folder."
      ],
      "prompts": [
        {
          "label": "New install",
          "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
        },
        {
          "label": "Upgrade existing",
          "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
        }
      ]
    },
    "sourceHealth": {
      "source": "tencent",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-04-23T16:43:11.935Z",
      "expiresAt": "2026-04-30T16:43:11.935Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard",
        "contentDisposition": "attachment; filename=\"4claw-imageboard-1.0.1.zip\"",
        "redirectLocation": null,
        "bodySnippet": null
      },
      "scope": "source",
      "summary": "Source download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this source.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/oauth"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    },
    "downloadPageUrl": "https://openagent3.xyz/downloads/oauth",
    "agentPageUrl": "https://openagent3.xyz/skills/oauth/agent",
    "manifestUrl": "https://openagent3.xyz/skills/oauth/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/oauth/agent.md"
  },
  "agentAssist": {
    "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
    "steps": [
      "Download the package from Yavira.",
      "Extract it into a folder your agent can access.",
      "Paste one of the prompts below and point your agent at the extracted folder."
    ],
    "prompts": [
      {
        "label": "New install",
        "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
      },
      {
        "label": "Upgrade existing",
        "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
      }
    ]
  },
  "documentation": {
    "source": "clawhub",
    "primaryDoc": "SKILL.md",
    "sections": [
      {
        "title": "Flow Selection",
        "body": "Authorization Code + PKCE: use for all clients—web apps, mobile, SPAs\nClient Credentials: service-to-service only—no user context\nImplicit flow: deprecated—don't use; was for SPAs before PKCE existed\nDevice Code: for devices without browsers (TVs, CLIs)—user authorizes on separate device"
      },
      {
        "title": "PKCE (Proof Key for Code Exchange)",
        "body": "Required for public clients (SPAs, mobile), recommended for all\nGenerate code_verifier: 43-128 char random string, stored client-side\nSend code_challenge: SHA256 hash of verifier, sent with auth request\nToken exchange includes code_verifier—server verifies against stored challenge\nPrevents authorization code interception—attacker can't use stolen code without verifier"
      },
      {
        "title": "State Parameter",
        "body": "Always include state in authorization request—prevents CSRF attacks\nGenerate random, unguessable value; store in session before redirect\nVerify returned state matches stored value before processing callback\nCan also encode return URL or other context (encrypted or signed)"
      },
      {
        "title": "Redirect URI Security",
        "body": "Register exact redirect URIs—no wildcards, no open redirects\nValidate redirect_uri on both authorize and token endpoints\nUse HTTPS always—except localhost for development\nPath matching is exact—/callback ≠ /callback/"
      },
      {
        "title": "Tokens",
        "body": "Access token: short-lived (minutes to hour), used for API access\nRefresh token: longer-lived, used only at token endpoint for new access tokens\nID token (OIDC): JWT with user identity claims—don't use for API authorization\nDon't send refresh tokens to resource servers—only to authorization server"
      },
      {
        "title": "Scopes",
        "body": "Request minimum scopes needed—users trust granular requests more\nScope format varies: openid profile email (OIDC), repo:read (GitHub-style)\nServer may grant fewer scopes than requested—check token response\nopenid scope required for OIDC—triggers ID token issuance"
      },
      {
        "title": "OpenID Connect",
        "body": "OIDC = OAuth 2.0 + identity layer—adds ID token and UserInfo endpoint\nID token is JWT with sub, iss, aud, exp + profile claims\nVerify ID token signature before trusting claims\nnonce parameter prevents replay attacks—include in auth request, verify in ID token"
      },
      {
        "title": "Security Checklist",
        "body": "HTTPS everywhere—tokens in URLs must be protected in transit\nValidate iss and aud in tokens—prevents token confusion across services\nBind authorization code to client—code usable only by requesting client\nShort authorization code lifetime (10 min max)—single use\nImplement token revocation for logout/security events"
      },
      {
        "title": "Common Mistakes",
        "body": "Using access token as identity proof—use ID token for authentication\nStoring tokens in localStorage—vulnerable to XSS; prefer httpOnly cookies or memory\nNot validating redirect_uri—allows open redirect attacks\nAccepting tokens from URL fragment in backend—fragment never reaches server\nLong-lived access tokens—use short access + refresh pattern"
      },
      {
        "title": "Token Endpoints",
        "body": "/authorize: user-facing, returns code via redirect\n/token: backend-to-backend, exchanges code for tokens; requires client auth for confidential clients\n/userinfo (OIDC): returns user profile claims; requires access token\n/revoke: invalidates tokens; accepts access or refresh token"
      },
      {
        "title": "Client Types",
        "body": "Confidential: can store secrets (backend apps)—uses client_secret\nPublic: cannot store secrets (SPAs, mobile)—uses PKCE only\nNever embed client_secret in mobile apps or SPAs—it will be extracted"
      }
    ],
    "body": "Flow Selection\nAuthorization Code + PKCE: use for all clients—web apps, mobile, SPAs\nClient Credentials: service-to-service only—no user context\nImplicit flow: deprecated—don't use; was for SPAs before PKCE existed\nDevice Code: for devices without browsers (TVs, CLIs)—user authorizes on separate device\nPKCE (Proof Key for Code Exchange)\nRequired for public clients (SPAs, mobile), recommended for all\nGenerate code_verifier: 43-128 char random string, stored client-side\nSend code_challenge: SHA256 hash of verifier, sent with auth request\nToken exchange includes code_verifier—server verifies against stored challenge\nPrevents authorization code interception—attacker can't use stolen code without verifier\nState Parameter\nAlways include state in authorization request—prevents CSRF attacks\nGenerate random, unguessable value; store in session before redirect\nVerify returned state matches stored value before processing callback\nCan also encode return URL or other context (encrypted or signed)\nRedirect URI Security\nRegister exact redirect URIs—no wildcards, no open redirects\nValidate redirect_uri on both authorize and token endpoints\nUse HTTPS always—except localhost for development\nPath matching is exact—/callback ≠ /callback/\nTokens\nAccess token: short-lived (minutes to hour), used for API access\nRefresh token: longer-lived, used only at token endpoint for new access tokens\nID token (OIDC): JWT with user identity claims—don't use for API authorization\nDon't send refresh tokens to resource servers—only to authorization server\nScopes\nRequest minimum scopes needed—users trust granular requests more\nScope format varies: openid profile email (OIDC), repo:read (GitHub-style)\nServer may grant fewer scopes than requested—check token response\nopenid scope required for OIDC—triggers ID token issuance\nOpenID Connect\nOIDC = OAuth 2.0 + identity layer—adds ID token and UserInfo endpoint\nID token is JWT with sub, iss, aud, exp + profile claims\nVerify ID token signature before trusting claims\nnonce parameter prevents replay attacks—include in auth request, verify in ID token\nSecurity Checklist\nHTTPS everywhere—tokens in URLs must be protected in transit\nValidate iss and aud in tokens—prevents token confusion across services\nBind authorization code to client—code usable only by requesting client\nShort authorization code lifetime (10 min max)—single use\nImplement token revocation for logout/security events\nCommon Mistakes\nUsing access token as identity proof—use ID token for authentication\nStoring tokens in localStorage—vulnerable to XSS; prefer httpOnly cookies or memory\nNot validating redirect_uri—allows open redirect attacks\nAccepting tokens from URL fragment in backend—fragment never reaches server\nLong-lived access tokens—use short access + refresh pattern\nToken Endpoints\n/authorize: user-facing, returns code via redirect\n/token: backend-to-backend, exchanges code for tokens; requires client auth for confidential clients\n/userinfo (OIDC): returns user profile claims; requires access token\n/revoke: invalidates tokens; accepts access or refresh token\nClient Types\nConfidential: can store secrets (backend apps)—uses client_secret\nPublic: cannot store secrets (SPAs, mobile)—uses PKCE only\nNever embed client_secret in mobile apps or SPAs—it will be extracted"
  },
  "trust": {
    "sourceLabel": "tencent",
    "provenanceUrl": "https://clawhub.ai/ivangdavila/oauth",
    "publisherUrl": "https://clawhub.ai/ivangdavila/oauth",
    "owner": "ivangdavila",
    "version": "1.0.0",
    "license": null,
    "verificationStatus": "Indexed source record"
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/oauth",
    "downloadUrl": "https://openagent3.xyz/downloads/oauth",
    "agentUrl": "https://openagent3.xyz/skills/oauth/agent",
    "manifestUrl": "https://openagent3.xyz/skills/oauth/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/oauth/agent.md"
  }
}