Waa maxay OAuth? "Sign in with Google" iyo gelitaanka loo wakiishay
OAuth waa heer furan oo u ogolaanaya isticmaaleyaha inuu app kale siiyo gelitaan xaddidan akoonkiisa adeeg kale, isagoo aan password-kiisa siinin. Markaad riixdo "Connect Google Calendar" oo aad aragto shaashad leh "Ma u ogolaatay app-kan inuu arko dhacdooyinkaaga?", taasi waa OAuth. App-ku wuxuu helaa token uu ogolaanshaha kaliya u leeyahay oo aad markasta joojin karto. Isla mashiinadaas, oo leh lakab dheeraad ah oo la yiraahdo OpenID Connect, ayaa awood u siiya "Sign in with Google" iyo badhamada la mid ah.
Waxa OAuth muhiimka ka dhigaya marka aad app ku dhisayso AI
OAuth waxa uu ka soo muuqdaa laba xaalad oo caadi ah marka aad app dhisayso:
- Login bulshada. Waxaad rabtaa isticmaalayaashaadu inay "Sign in with Google" (ama Apple, Microsoft, GitHub) ku galaan halkii ay akoon password cusub abuuri lahaayeen. Eeg sida loo ku darayo login app-kaaga.
- Ku xidhida akoonada isticmaaleyaasha adeegyada kale. App-kaagu wuxuu u baahan yahay inuu akhriyo calendar-ka isticmaaleyaha, uu ku daabaco akoonkiisa bulshada, uu soo qaado faylal ka drive-kiisa ama uu xogta xisaabaadkiisa la wadaago.
Dhammaan xaaladahaas labadaba AI builder-kaagu wuu qori karaa code-ka, laakiin tallaabooyin qaarkood waxaa keliya kugu ku habboon adiga: abuurista app horumariye ee bixiyaha, hel client ID iyo client secret, diiwaangeli URL-yada callback, iyo, oo ogolaanshaha qaarkood, gudi dib-u-eegista bixiyaha. Garashada sida OAuth u shaqeeyo waxay tallaabooyinkaas — iyo khaladaadka ay keenaan — ka dhigaysaa kuwo aan aad uga welwelin. Sawirka weyn ee login-ka, eeg waa maxay authentication.
Tusaale maalmaha ah
Ku fikir furaha kaarka hoteelka. Markii aad gasho, miiska hore wuxuu xaqiijiyaa qofka aad tahay, kadibna wuxuu siiyaa kaarka oo furaya qolkaaga iyo jimicsiga — ma aha qolalka kale, ma aha meelaha shaqaalaha — oo wuu joogsanayaa shaqaynta marka aad ka baxdo. Kaarku ma laha baasaboorkaaga. Haddii aad lumiso, miiska ayaa joojiya oo wuxuu kuu siiyaa mid cusub.
- Miiska hore waa server-ka ogolaanshaha (bogga galitaanka Google).
- Hubinta aqoonsigaaga waa markaad gashid Google.
- Kaarka furaha waa access token-ka.
- "Qolka iyo jimicsiga oo keliya" waa scopes-ka aad ogolaatay.
- Ka baxida waa markii token-ku dhaco, ama aad joojiso gelitaanka.
App-ka aad isticmaalayso ma arko password-kaaga Google, wuxuu arkaa kaarka furaha oo keliya.
OAuth sida uu u shaqeeyo, tallaabo tallaabo
Habka caadiga ah ee websaydhyada waa authorization code flow. Waa waxa dhaca marka isticmaale uu ku xidhayo Google Calendar-kiisa app qorshe-samaynta:
- Riix. Isticmaaleyaha wuxuu riixayaa "Connect Google Calendar."
- U wareeji provider-ka. App-ku wuxuu browser-ka u diraa Google isagoo leh client ID-kiisa, scopes-ka uu doonayo (akhri dhacdooyinka calendar-ka) iyo redirect URI-ga halkaas oo Google ku celin doono isticmaaleyaha.
- Gal oo oggolow. Isticmaaleyaha wuxuu galaa Google (haddii aanu horay u galin) wuxuuna arkaa shaashad oggolaansho oo liistaysa waxa app-ku weydiinayo. Wuxuu riixayaa Allow.
- Dib ugu soo laab code-ka. Google wuxuu browser-ka dib ugu celinayaa redirect URI-ga app-ka isagoo leh authorization code gaaban oo mar keliya la isticmaali karo.
- Ku beddel server-ka. Server-ka app-ku wuxuu codkaas, iyo client secret-ka, si toos ah ugu diraa Google wuxuuna helaa access token (iyo inta badan refresh token).
- Isticmaal API-ga. Server-ku wuxuu u yeeraa Google Calendar API access token-ka oo wuxuu helaa dhacdooyinka isticmaaleyaha.
Callback-ka tallaabada 4 wuxuu u eg yahay sidan:
https://yourapp.com/auth/google/callback?code=4/0Adeu5B...&state=x7Kq9
Jawaabta token-ka ee tallaabada 5 waa JSON sidan oo kale ah:
{
"access_token": "ya29.a0Af...",
"expires_in": 3599,
"refresh_token": "1//0gL...",
"scope": "https://www.googleapis.com/auth/calendar.readonly",
"token_type": "Bearer"
}
Naqshadeynta muhiimka ah: beddelka token-ka wuxuu dhacaa server-ka ilaa server-ka, sidaas darteed client secret-ka iyo tokens-ka uma baahna inay mararka qaarkood ku maraan browser-ka.
OAuth vs OpenID Connect vs login-kaaga
| Waxa ay jawaabta u tahay | Tusaale | |
|---|---|---|
| OAuth 2.0 | "Maxaa app-kani u ogolaaday inuu isticmaaleyaha ku sameeyo?" (ogolaansho) | Akhri calendar-ka isticmaaleyaha |
| OpenID Connect (OIDC) | "Yaa isticmaaleyahan?" (xaqiijin), oo ku dhisan OAuth | "Sign in with Google" oo soo celinaya email la xaqiijiyay |
| Login-kaaga | "Password-kan ma waa kan saxda ah ee akoonkan?" | Email iyo password la kaydiyay (hashed) database-kaaga |
App-yo badan waxay isku daraan: login email iyo password, iyo "Sign in with Google" oo ah OIDC, iyo xidhiidhyo OAuth gaar ah oo adeegyada kale.
Ereyada muhiimka ah
| Ereyga | Macnaha |
|---|---|
| Provider / authorization server | Adeegga isticmaaleyaha ku galo oo oggolaansho ku siiyo — Google, Microsoft, GitHub. |
| Client | App-kaaga sida loo diiwaangeliyay provider-ka. |
| Client ID | Aqoonsiga app-kaaga oo dadweyn ah ee provider-ka. |
| Client secret | Password-ka gaarka ah ee app-kaaga provider-ka. Server-ka oo keliya. |
| Scope | Ogolaansho gaar ah, sida "akhri calendar" ama "arag cinwaanka email-ka." |
| Consent screen | Bogga isticmaaleyuhu ku arko oo ansixiyo scopes-ka la weydiiyay. |
| Redirect URI / callback URL | Halka provider-ku isticmaaleyaha dib ugu celiyo. Waa in hore loo diiwaangeliyaa oo sax u ahaadaa. |
| Access token | Aqoonsi gaaban oo loo isticmaalo in API la wicito. |
| Refresh token | Aqoonsi dheer oo loo isticmaalo in access token cusub la helo. Ku kaydi sida password. |
| ID token | OIDC-ka, token saxeexan oo sharaxaya qofka isticmaalaya. |
| PKCE | Hubin dheeraad ah ("proof key") oo ka hortagta in code la hadhay loo isticmaalo. Waxaa lagu taliyaa dhammaan clients-ka. |
| state | Qiime random ah oo ilaalinta socodka ka dhigta codsiyada been abuurka ah. |
Fikradaha qaldan ee caadiga ah
- "OAuth waa nidaam login." OAuth caadi ahaan wuxuu siiyaa gelitaan; OpenID Connect ayaa maamula aqoonsiga. Isticmaalka access token-ka oo keliya sida caddeyn qofka uu yahay wuxuu sababay cilado amni oo dhab ah.
- "App-ku password-kaaga wuu helaa." Ma helo. Taasi waa ujeedada.
- "Scopes dheeraad ah weydiinta waa mid aan waxba dhibayn." Isticmaaleyaasha ayaa ka digta codsiyada baaxadda leh, bixiyayaasha sida Google waxay u baahan karaan dib-u-eegis app-ka scopes-ka xasaasiga ah ama xaddidan. Weydii kaliya waxa aad u baahan tahay.
- "Client secret-ka wuu geli karaa frontend-ka." Wax kasta oo ku jira code-ka browser-ka waa dadweyn. Ku hay sirta server-ka.
- "Waxay shaqeysaa tijaabada, markaa production-ka way shaqeysaa." Bixiyayaashu badanaa waxay xaddidaan apps aan la xaqiijin — tusaale ahaan, liis isticmaaleyaal tijaabo — URL-ka dib u jiheynta domain-kaaga toosa waa in si gaar ah loo diiwaangeliyo.
- "Tokens-ku waligood waa jiraan." Access tokens-ku waxay dhaqsi dhacaan, isticmaaleyaashuna way joojin karaan gelitaanka. App-kaagu waa inuu maamulo labadaba si wanaagsan.
Waxa aad ka codsan karto app builder-kaaga AI
- "Ku dar 'Sign in with Google' adigoo isticmaalaya OpenID Connect iyo maktabad auth oo la ilaaliyo — ha qorin habka OAuth gacanta."
- "Isticmaal authorization code flow oo leh PKCE, oo hubi parameter-ka
state." - "Akhri client ID-ka iyo client secret-ka environment variables-ka server-ka."
- "Weydii kaliya scopes-ka aan u baahanahay: akhrinta calendar-ka oo keliya."
- "Ii sheeg URL kasta oo dib u jiheyn ah ee aan u baahan diiwaangelinta console-ka bixiyaha, preview-ka, URL-ka la daabacay iyo domain-kayga gaarka ah."
- "Ku kaydi refresh tokens-ka si sirtaa ah database-ka, oo maamul tokens-ka dhacay ama la joojiyay adigoo weydiinaya isticmaaleyaha inuu dib u xidho."
- "Ogolow isticmaaleyaasha inay ka jaraan isku xidhka bogga settings-kooda."
OAuth iyo Mythex
Mythex ma laha login dhex-dhisan oo isticmaaleyaasha app-yada aad dhisato; docs-kiisa waxay sharxayaan habka "bring-your-own" — waxaad dooranaysaa maktabad auth ama bixiye loo martiqaado, furayaashiisa waxaad ku kaydinaysaa project secrets, agent-kuna wuxuu qoraa code-ka. Add authentication recipe wuxuu leeyahay prompt bilow oo tan ku saabsan. Waxaad sidoo kale ka arki doontaa OAuth Mythex laftiisa: waxaad ku diiwaangelin kartaa Google; ku xidhida GitHub ee repo sync-ka waxay isticmaashaa GitHub OAuth; caawiyayaasha AI ee ku xidha Mythex MCP-da waxay mareen bogga oggolaanshaha OAuth. Wixii dheeraad ah, eeg waa maxay authentication iyo waa maxay two-factor authentication.
Su'aalaha
Waa maxay OAuth si fudud?
OAuth waa habka caadiga ah ee isticmaaleyaha u ogolaanayo app inuu gaaro akoonkiisa adeeg kale — sida app qorshe-samaynta oo akhrisa Google Calendar-kiisa — isagoo aan password-kiisa siinin app-kaas. Isticmaaleyaha ayaa ansixiya ogolaansho gaar ah, app-kuna wuxuu helaa token uu isticmaali karo kaliya ogolaanshaas.
OAuth ma la mid yahay "Sign in with Google"?
"Sign in with Google" waxa lagu dhisay OAuth 2.0 iyo OpenID Connect, oo ah lakab ku dul yaal OAuth oo ku daraya habka caadiga ah ee lagu sheegi karo app-ka qofka isticmaalaya. OAuth laftiisu waa gelitaan oggolaansho; OpenID Connect ayaa ka dhigaya login.
Waa maxay OAuth access token?
Access token waa aqoonsi uu app-ku u diro API-ga adeegga si uu u caddeeyo in la siiyay gelitaan. Inta badan waa gaagaaban yahay oo waxaa ku xaddidan ogolaanshaha (scopes) ee isticmaaleyaha ansixiyay. Refresh token, haddii la siiyo, wuxuu u ogolaanayaa app-ka inuu helo access token cusub isagoo aan isticmaaleyaha dib u weydiinin.
Maxaa loo yaqaan redirect_uri_mismatch?
Waxay macneyso in URL-ka callback ee app-kaagu u diray inta lagu jiro gelitaanka aanu u eka mid saxan oo laga diiwaangeliyay console-ka horumariyaha ee bixiyaha. Ku dar URL-ka saxda ah — oo ay ku jiraan https, domain, jid iyo calaamadda slash-ka ee dambe haddii ay jirto — cinwaan kasta oo app-kaagu ku shaqeeyo.
OAuth ammaan ma leeyahay?
OAuth 2.0 si ballaadhan ayaa loo isticmaalaa oo ammaan ayuu leeyahay marka si sax ah loo hirgeliyo: isticmaalka authorization code flow oo leh PKCE, URL-yada dib u jiheynta oo saxda ah, parameter-ka state, iyo ilaalinta client secret-ka iyo tokens-ka server-ka. Dhibaatooyinka badankood waxay ka yimaadaan gaaban-jaranka hirgelinta, sidaas darteed waxaa lagu talinayaa isticmaalka maktabad la ilaaliyo oo wanaagsan.