AUTH V2 overview

import * as client from "openid-client";

// algorithm: "oauth2" is required. Without it the library looks for an
// OpenID Connect document, and Simkl publishes the OAuth 2.0 one.

// Mobile, desktop & browser apps / TV, devices & command line — no secret.
// client.None() is required: the default is client_secret_post, which would
// try to send a secret you do not have.
const config = await client.discovery(
  new URL("https://simkl.com"),
  "YOUR_CLIENT_ID",
  undefined,
  client.None(),
  { algorithm: "oauth2" },
);

// Server apps & services — the third argument is a client_secret shorthand,
// and the default client_secret_post is what you want, so leave the fourth out.
const config = await client.discovery(
  new URL("https://simkl.com"),
  "YOUR_CLIENT_ID",
  "YOUR_CLIENT_SECRET",
  undefined,
  { algorithm: "oauth2" },
);

# Discovery lives on Authlib's framework integrations, which share one API --
# swap flask_client for django_client or starlette_client as needed. The plain
# requests_client OAuth2Session does not read metadata; set endpoints by hand there.
from authlib.integrations.flask_client import OAuth

oauth = OAuth()
oauth.register(
    name="simkl",
    client_id="YOUR_CLIENT_ID",
    # Supplies authorize_url and access_token_url, so you do not set them.
    server_metadata_url="https://simkl.com/.well-known/oauth-authorization-server",
    client_kwargs={
        "scope": "media:read media:write",
        "code_challenge_method": "S256",        # PKCE; S256 is the only method Authlib supports
        "token_endpoint_auth_method": "none",   # no secret. For Server apps & services,
                                                # drop this line and pass client_secret="..."
    },
)

# issuer-uri is all you need: Spring reads the discovery document and fills in
# the endpoints itself. Write it with NO trailing slash -- "https://simkl.com/"
# is a different issuer string and fails to resolve.
spring:
  security:
    oauth2:
      client:
        registration:
          simkl:
            client-id:                    YOUR_CLIENT_ID
            client-secret:                YOUR_CLIENT_SECRET   # server apps only
            client-authentication-method: client_secret_basic  # use "none" if you have no secret
            authorization-grant-type:     authorization_code
            redirect-uri:                 "{baseUrl}/login/oauth2/code/{registrationId}"
            scope:                        media:read,media:write
        provider:
          simkl:
            issuer-uri: https://simkl.com