Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Open-source OAuth service for 40+ APIs

nango.dev

Post reply on HN
Print view View original

31–40 of 60 posts

Re: Show HN: Open-source OAuth service for 40+ APIs

#31

Post by mooreds »

This is really cool. One thing to note is that they store the tokens server side (in the db).

This is the BFF pattern, where the browser/native client that needs, say, GitHub or Google Calendar data, has to go through Nango to make those requests. (More here: https://docs.nango.dev/reference/guide#node-sdk )

That works well for a large class of problems, but I've seen some architectures where the token is stored client side, so that you don't have to worry about the proxy (Nango in this case) being a chokepoint. YMMV, but I thought it was worth calling out.

Re: Show HN: Open-source OAuth service for 40+ APIs

#32

Post by rguldener »

Ataraxy wrote: post #29

One thing I always wished Pizzly would have added was regular api key based authentication alongside oauth. Make it suitable for all integration authentication possibilities.

This is a use case we have on the radar and would love to support.

Would be great to hear more about your use case for this, feel free to message me on our community or on robin (at) nango (dot) dev

Re: Show HN: Open-source OAuth service for 40+ APIs

#33

Post by mooreds »

Ataraxy wrote: post #29

One thing I always wished Pizzly would have added was regular api key based authentication alongside oauth. Make it suitable for all integration authentication possibilities.

I'm not quite sure how this would work. Are you saying that Nango (nee Pizzly) would be configured with an API key to, say, Stripe, and then you'd route your browser/native app Stripe requests through Nango and it would proxy them?

Or am I missing something?

Re: Show HN: Open-source OAuth service for 40+ APIs

#34

Post by jamesmcintyre »

rguldener wrote: post #20
jamesmcintyre wrote: post #13

As soon as I saw this I planned on asking in the comments how it compares to Pizzly, great to see that this already awesome project is getting relaunched as a dedicated, OSS startup! Also, last time I checked out pizzly I do not remember seeing any of the "sync" type functionality and the fact that you've added that recently with Temporal is awesome! You guys are awesome for putting open-source as a high priority! Is…

Thanks for the kind words! Yes we are thinking about bringing the proxy back as well. Probably with some added features, such as rate-limit handling and automatic retries (powered by Temporal). The proxy edge deployment idea is interesting. Would you be calling it directly from your frontend/mobile code? We were thinking most people would want to have the proxy as close to their backend as possible, but maybe we are…

Glad to hear the proxy is in the plans!

Yea you're probably right, most applications would best fit the proxy living close to the backend.

One reason to run on the edge would be if the edge "worker" could retrieve the required token(s) from an edge db and attach it as a header to the request going through to the BE app server so that it can then immediately make the requests directly to the 3rd party api. (Though this likely only simplifies the design for the devs a bit and performance is nearly identical)

Another reason, likely less common use case, is if you could keep certain data from 3rd party api's always fresh/cached at the edge. So for instance Cloudflare worker KV store has an api to update records (perhaps from a normal nango server instance that's maintaining updating/syncing the records) so that this data can be "injected" as json into the body of an html response. This is definitely a niche use case though, lol.

Congrats on YC and the launch!

Re: Show HN: Open-source OAuth service for 40+ APIs

#35

Post by darthpotter »

robertwt7 wrote: post #23

This is very similar to keycloak right? I use next auth when developing using nextJS but mostly always use my own backend to manage the auth and tokens even though they offer schema for backend integration. There has been many discussion and confusion at next auth repo on the flow to register user to backend services after getting the token from sso services. I’ve never heard or encounter issues related to saving the…

you could interface a keycloak with nango, so nango would stand between your app and keycloak or any other identity provider like github, ...

Re: Show HN: Open-source OAuth service for 40+ APIs

#36

Post by pcj-github »

Worth mentioning: https://docs.nango.dev/nango-deploy/oss-limitations

To keep the setup of the Nango open source version simple we have made some choices that may not be ideal for production. Please take them into consideration before using it in production:

The database is bundled in the docker container with transient storage. This means that updating the Docker image causes configs/credentials loss. We recommend that you connect Nango to a production DB that lives outside the docker setup to mitigate this.

Credentials are not encrypted at rest and stored in plain text

No authentication by default

No SSL setup by default

The setup is not optimized for scaling

Updating the provider templates requires an update of the docker containers

Re: Show HN: Open-source OAuth service for 40+ APIs

#37

Post by ezekg »

benatkin wrote: post #7

It's not under an OSI-approved license. https://github.com/NangoHQ/nango/blob/master/LICENSE

OSI doesn't own the term "open source" [0] [1]

[0]: https://writing.kemitchell.com/2019/05/05/Rely-on-OSI.html

[1]: https://writing.kemitchell.com/2021/03/18/You-Can-Still-Use-...

Re: Show HN: Open-source OAuth service for 40+ APIs

#38

Post by benatkin »

ezekg wrote: post #37
benatkin wrote: post #7

It's not under an OSI-approved license. https://github.com/NangoHQ/nango/blob/master/LICENSE

OSI doesn't own the term "open source" [0] [1] [0]: https://writing.kemitchell.com/2019/05/05/Rely-on-OSI.html [1]: https://writing.kemitchell.com/2021/03/18/You-Can-Still-Use-...

Yes they do. They applied for a trademark and were unfairly denied one. Why does Apple get a trademark on Apple?

Trademark or no, enough people were on-board with the OSI and OSD at the time it became a well known and established term that we have a claim to it.

touch .well-known/open-source

Re: Show HN: Open-source OAuth service for 40+ APIs

#39

Post by derekperkins »

benatkin wrote: post #38
ezekg wrote: post #37

Earlier quoted context omitted.

OSI doesn't own the term "open source" [0] [1] [0]: https://writing.kemitchell.com/2019/05/05/Rely-on-OSI.html [1]: https://writing.kemitchell.com/2021/03/18/You-Can-Still-Use-...

Yes they do. They applied for a trademark and were unfairly denied one. Why does Apple get a trademark on Apple? Trademark or no, enough people were on-board with the OSI and OSD at the time it became a well known and established term that we have a claim to it. touch .well-known/open-source

Your argument is that they own it despite courts denying it?

Re: Show HN: Open-source OAuth service for 40+ APIs

#40

Post by benatkin »

derekperkins wrote: post #39
benatkin wrote: post #38

Earlier quoted context omitted.

Yes they do. They applied for a trademark and were unfairly denied one. Why does Apple get a trademark on Apple? Trademark or no, enough people were on-board with the OSI and OSD at the time it became a well known and established term that we have a claim to it. touch .well-known/open-source

Your argument is that they own it despite courts denying it?

Yes - "Trademark or no"

Also the institution has proven to be stronger than one individual.

https://www.theregister.com/2020/01/03/osi_cofounder_resigns...?

Post reply on HN