AI Platform App Integration Tutorial: User Authorization with OAuth Code Flow and PKCE

2026-11-11 · 原创·功能教程

App Integration: Let Users Authorize Your Application

For developers new to AI platform app integration, the first goal is simple: let users authorize your application so it can work within the permissions they grant. This tutorial follows four steps: preparation, operation, result checking, and security notes. The documented entry point is `/docs#docs-oauth`.

1. Prepare: confirm client type and scopes

Start with `/docs#docs-oauth` and confirm whether your application is a public client. The verified requirement is that public clients must use S256. Then list the minimum scopes your business needs; request only required scopes and avoid permissions unrelated to the current feature. Also note that ext balance and usage scopes are separate. Do not treat them as one authorization goal.

2. Operate: use OAuth authorization code flow with PKCE

Integration uses the OAuth authorization code flow with PKCE. When starting authorization, create and validate the PKCE parameters as required by the documentation; public clients must use S256. Guide the user through authorization, then exchange the authorization code for access credentials. Request only the minimum scopes you have confirmed, so users can understand what they are authorizing. Never expose ext tokens in browser frontend code. When ext-related capabilities are needed, handle them securely on the server side.

3. Check results: authorization and usage

After authorization, the application can call within the granted scopes. If you need tiered calls or want to view app-scoped usage, follow `/docs#docs-oauth` to confirm how app-level usage is viewed, and keep balance permissions separate from usage permissions. Do not infer quotas, prices, or parameters from unverified screens or external memory.

4. Security notes

First, public clients must use S256. Second, request minimal scopes by business need, and evaluate balance and usage permissions separately. Third, do not send ext tokens to browser frontend code, and do not expose them in logs or client code. Fourth, if authorization fails or permissions are insufficient, check the scopes and client type first, then return to the documentation to verify the flow. Once these steps are complete, you can continue exploring app integration capabilities in the model marketplace or the corresponding tool.