Development/OAuth2

From MusicBrainz Wiki

OAuth2 is a protocol that lets external applications request authentication of the user and authorization to perform actions using the web service on their behalf without getting their password. It is an alternative to HTTP Digest Access Authentication that MusicBrainz currently uses.

Basic steps

Registering an application

All developers need to register their application before getting started. A registered OAuth application is assigned a unique Client I and Client Secret. The OAuth protocol recognizes two types of applications:

  1. Confidential - Applications that can keep secrets. Typically web applications, running on a server.
  2. Public - Applications that have their code exposed to the public and therefore cannot keep secrets. There are typically installed desktop applications or web applications running in the browser.

Client Secret assigned to Confidential applications should not be shared. This does not apply to Public applications, in which case the assigned Client Secret is not treated as a secret and can be embedded in the application code.

Obtaining access token

...

Using access token

After an application has obtained an access token, it may use the token in the web service to get user details or submit data to MusicBrainz on the user's behalf. There are two types of access tokens:

  1. Bearer - Very easy to use, but can be used only over HTTPS.
  2. MAC - Requires requests to be signed with a secret, but can be used over both HTTP and HTTPS.

Refreshing access token

Access tokens have a limited life-time. During the authorization process, application receives a refresh token, in addition to the first access token. This refresh token allows applications to obtain new access tokens.

Authorization

Scopes

Authorization requests have a limited scope. You should request only the scopes that your application necessarily needs. The following scopes are available in the MusicBrainz OAuth implementation:

profile
View the user's public profile information (username, age, country, homepage).
email
View the user's email.
tag
View and modify the user's private tags.
rating
View and modify the user's private ratings.
collection
View and modify the user's private collections.
submit_puid
Submit new PUIDs to the database.
submit_isrc
Submit new ISRCs to the database.
submit_barcode
Submit barcodes to the database.

Access token usage

...