OAuth 2.0 + PKCE for public clients

import android.util.Base64
import androidx.browser.customtabs.CustomTabsIntent
import okhttp3.*
import org.json.JSONObject
import java.security.MessageDigest

fun base64url(bytes: ByteArray): String =
  Base64.encodeToString(bytes, Base64.URL_SAFE or Base64.NO_PADDING or Base64.NO_WRAP)

// Step 1 — verifier + challenge
val verifier  = base64url((1..32).map { (0..255).random().toByte() }.toByteArray())
val challenge = base64url(MessageDigest.getInstance("SHA-256").digest(verifier.toByteArray()))
val state     = java.util.UUID.randomUUID().toString()
// Persist verifier + state somewhere your redirect handler can read them.

// Step 2 — launch a Custom Tab
val authUri = Uri.parse("https://simkl.com/oauth/authorize").buildUpon()
  .appendQueryParameter("response_type",         "code")
  .appendQueryParameter("client_id",             "YOUR_CLIENT_ID")
  .appendQueryParameter("redirect_uri",          "myapp://oauth")
  .appendQueryParameter("code_challenge",         challenge)
  .appendQueryParameter("code_challenge_method", "S256")
  .appendQueryParameter("state",                 state)
  .appendQueryParameter("app-name",              "my-app-name")
  .appendQueryParameter("app-version",           "1.0")
  .build()
CustomTabsIntent.Builder().build().launchUrl(context, authUri)

// Step 3 — in the activity that handles myapp://oauth?code=...&state=...
fun handleRedirect(intent: Intent) {
  val data = intent.data ?: return
  if (data.getQueryParameter("state") != savedState) return  // CSRF check
  val code = data.getQueryParameter("code") ?: return

  val body = JSONObject(mapOf(
    "code"          to code,
    "client_id"     to "YOUR_CLIENT_ID",
    "code_verifier" to savedVerifier,
    "redirect_uri"  to "myapp://oauth",
    "grant_type"    to "authorization_code",
  )).toString()
  val req = Request.Builder()
    .url("https://api.simkl.com/oauth/token")
    .header("User-Agent", "my-app-name/1.0")
    .post(body.toRequestBody("application/json".toMediaType()))
    .build()
  OkHttpClient().newCall(req).enqueue(object : Callback {
    override fun onResponse(call: Call, response: Response) {
      val token = JSONObject(response.body!!.string()).getString("access_token")
      // Save token to EncryptedSharedPreferences.
    }
    override fun onFailure(call: Call, e: IOException) { /* handle */ }
  })
}

// Step 1 — verifier + challenge (run once before redirecting)
const base64url = bytes =>
  btoa(String.fromCharCode(...bytes))
    .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

const verifier  = base64url(crypto.getRandomValues(new Uint8Array(32)));
const challenge = base64url(new Uint8Array(
  await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))
));
const state = crypto.randomUUID();

// Persist verifier + state across the redirect.
sessionStorage.setItem("pkce_verifier", verifier);
sessionStorage.setItem("pkce_state",    state);

// Step 2 — full-page redirect to the consent screen
const params = new URLSearchParams({
  response_type:         "code",
  client_id:             "YOUR_CLIENT_ID",
  redirect_uri:          location.origin + "/callback",
  code_challenge:        challenge,
  code_challenge_method: "S256",
  state,
  "app-name":            "my-app-name",
  "app-version":         "1.0",
});
location.href = `https://simkl.com/oauth/authorize?${params}`;

// Step 3 — on /callback after the redirect lands
const qs = new URLSearchParams(location.search);
if (qs.get("state") !== sessionStorage.getItem("pkce_state")) {
  throw new Error("State mismatch — possible CSRF attempt");
}
const r = await fetch("https://api.simkl.com/oauth/token", {
  method:  "POST",
  headers: { "Content-Type": "application/json" },
  body:    JSON.stringify({
    code:          qs.get("code"),
    client_id:     "YOUR_CLIENT_ID",
    code_verifier: sessionStorage.getItem("pkce_verifier"),
    redirect_uri:  location.origin + "/callback",
    grant_type:    "authorization_code",
  }),
});
const { access_token } = await r.json();
sessionStorage.removeItem("pkce_verifier");
sessionStorage.removeItem("pkce_state");
// Send `access_token` to your backend to set as an httpOnly cookie.

import base64, hashlib, secrets, urllib.parse, webbrowser, http.server, threading
import requests

# Step 1 — verifier + challenge
verifier  = base64.urlsafe_b64encode(secrets.token_bytes(32)).rstrip(b"=").decode()
challenge = base64.urlsafe_b64encode(
    hashlib.sha256(verifier.encode()).digest()
).rstrip(b"=").decode()
state = secrets.token_urlsafe(16)

# Step 2 — open the user's browser to the consent page
auth_url = "https://simkl.com/oauth/authorize?" + urllib.parse.urlencode({
    "response_type":         "code",
    "client_id":             "YOUR_CLIENT_ID",
    "redirect_uri":          "http://127.0.0.1:8765/callback",
    "code_challenge":        challenge,
    "code_challenge_method": "S256",
    "state":                 state,
    "app-name":              "my-app-name",
    "app-version":           "1.0",
})
webbrowser.open(auth_url)

# Spin up a one-shot loopback server to capture the redirect.
code_holder: dict[str, str] = {}
class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        qs = urllib.parse.parse_qs(urllib.parse.urlparse(self.path).query)
        if qs.get("state", [None])[0] != state:
            self.send_response(400); self.end_headers(); return
        code_holder["code"] = qs["code"][0]
        self.send_response(200); self.end_headers()
        self.wfile.write(b"Done — you can close this tab.")
    def log_message(self, *a): pass

server = http.server.HTTPServer(("127.0.0.1", 8765), Handler)
threading.Thread(target=server.handle_request, daemon=True).start()
# Block until the redirect has been handled (or the user cancels).
while "code" not in code_holder:
    pass

# Step 3 — exchange
r = requests.post(
    "https://api.simkl.com/oauth/token",
    headers={"User-Agent": "my-app-name/1.0"},
    json={
        "code":          code_holder["code"],
        "client_id":     "YOUR_CLIENT_ID",
        "code_verifier": verifier,
        "redirect_uri":  "http://127.0.0.1:8765/callback",
        "grant_type":    "authorization_code",
    },
)
access_token = r.json()["access_token"]