Show HN: Open-source OAuth service for 40+ APIs

Ok, so the use case is that if I want to get commits from github - I'm better off using github Api directly - but if I want to get commits from github, gitlab, bit bucket etc - this will help me with the authentication part?

This is very similar to keycloak right? I use next auth when developing using nextJS but mostly always use my own backend to manage the auth and tokens even though they offer schema for backend integration. There has been many discussion and confusion at next auth repo on the flow to register user to backend services after getting the token from sso services. I’ve never heard or encounter issues related to saving the tokens or managing them but i do hope that this product solves some of the pain point for next auth.

Thanks for keeping Pizzly alive!

This is cool. I like the frontend aspect. Looks really handy for a lot of apps where integration with other services is a core feature (I've built several just over the past few years, so I definitely get it).

I do wish it supported encrypted storage. For example, I wrote/maintain a Vault plugin to do basically the same work as the backend side of this project[0]. I wonder if you would be interested in supporting Vault as a backend in addition to PostgreSQL down the line? Feel free to reach out if so.

To answer your question:

Like some others here, I haven't found the actual integration points to be terribly difficult with most OAuth 2 servers. Once you have a token, you can call their APIs. No problem. I wrote the Vault plugin I referenced above to basically just do automatic refreshes without ever exposing client secrets/refresh tokens to our services, and it works fine.

Rather our customers would get into situations where they inadvertently revoked access, the user that authorized the integration initially left the company and it was automatically disabled, etc. and there was no notification that it happened. Basically all of the lifecycle management side that couldn't be automated down to "refresh my token when it's about to expire" sucked. So anything you're looking to support there would be a huge value-add IMO.

Another one is that each provider has their own scope definitions/mapping to their APIs. Some scopes subsume others (e.g. GitHub has all repos, public repos, org admin, org read-only, etc.). Some get deprecated and need to be replaced with others on the next auth attempt. We could never keep them up to date because they were usually just part of docs, not enumerated through some API somewhere. If you had a way to provide the user with a way to see and select those scopes in advance, that would be huge. Think if my app or a user could answer the question "I want to call this API endpoint, what scopes do I need?" by just asking your service to figure it out.

[0]: https://github.com/puppetlabs/vault-plugin-secrets-oauthapp

One thing I always wished Pizzly would have added was regular api key based authentication alongside oauth.

Make it suitable for all integration authentication possibilities.