Third-party apps
Your customers connect their Meteor to your product without handing you a key
If what you build installs on someone else’s account, asking for a key over chat is the worst way to do it. There is a better one, and it is standard.
- 1
You register your app
From Settings and Developers. You get a client identifier, and a secret if your app can keep one. You declare up front the maximum scopes your app will ever be able to request.
- 2
Your user approves what they see
You redirect them to Meteor’s consent screen, where your app and the exact permissions you are asking for are shown. They approve a subset of what you declared, never more.
- 3
You exchange the code for a token
Authorization code with PKCE required, so the flow is also safe for native and single-page apps that cannot keep a secret. The access token lasts one hour.
- 4
You refresh with rotation
Every refresh issues a new token and invalidates the previous one. If a stolen token is replayed, the whole session revokes itself.
- 5
The user stays in charge
Whoever authorized you sees your app in their account and revokes your access whenever they want, cascading across every token. And you find out: there are outbound events when an account authorizes your app and when it revokes it.
OAuth tokens operate the same public API, with the same scopes, the same quota
and the same Energy as a key. There is no separate surface to learn.