Skip to content

Commit 0213c8c

Browse files
authored
code formatting on the user verifier guide (#601)
1 parent 6f0d1df commit 0213c8c

File tree

1 file changed

+59
-16
lines changed
  • app/en/home/auth/secure-auth-production

1 file changed

+59
-16
lines changed

app/en/home/auth/secure-auth-production/page.mdx

Lines changed: 59 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -8,28 +8,35 @@ description: "How to secure and brand your auth flows in production"
88
To keep your users safe, Arcade.dev performs a user verification check when a tool is authorized for the first time. This check verifies that the user who is authorizing the tool is the same user who started the authorization flow, which helps prevent phishing attacks.
99

1010
There are two ways to secure your auth flows with Arcade.dev:
11+
1112
- Use the **Arcade user verifier** for development (enabled by default)
1213
- Implement a **custom user verifier** for production
1314

1415
This setting is configured in the [Auth > Settings section](https://api.arcade.dev/dashboard/auth/settings) of the Arcade Dashboard.
1516

16-
1717
## Use the Arcade user verifier
1818

1919
If you're building a proof-of-concept app or a solo project, use the Arcade user verifier. This option requires no custom development and is on by default when you create a new Arcade.dev account.
2020

2121
This setting is configured in the [Auth > Settings section](https://api.arcade.dev/dashboard/auth/settings) of the Arcade Dashboard:
2222

23-
<img src="/images/docs/auth/dashboard-arcade-verifier.png" alt="An image showing how to pick the Arcade user verifier option in the Arcade Dashboard" className="rounded-sm shadow-md" width="600" />
23+
<img
24+
src="/images/docs/auth/dashboard-arcade-verifier.png"
25+
alt="An image showing how to pick the Arcade user verifier option in the Arcade Dashboard"
26+
className="rounded-sm shadow-md"
27+
width="600"
28+
/>
2429

2530
When you authorize a tool, you'll be prompted to sign in to your Arcade.dev account. If you are already signed in (to the Arcade Dashboard, for example), this verification will succeed silently.
2631

2732
The Arcade.dev user verifier helps keep your auth flows secure while you are building and testing your agent or app. When you're ready to share your work with others, implement a [custom user verifier](#build-a-custom-user-verifier) so your users don't need to sign in to Arcade.dev.
2833

2934
<Callout type="info">
3035
Arcade's default OAuth apps can *only* be used with the Arcade user verifier.
31-
If you are building a multi-user production app, you must obtain your own OAuth app credentials and add them to Arcade.
32-
For example, see our docs on [configuring Google auth in the Arcade Dashboard](/home/auth-providers/google#access-the-arcade-dashboard).
36+
If you are building a multi-user production app, you must obtain your own
37+
OAuth app credentials and add them to Arcade. For example, see our docs on
38+
[configuring Google auth in the Arcade
39+
Dashboard](/home/auth-providers/google#access-the-arcade-dashboard).
3340
</Callout>
3441

3542
## Build a custom user verifier
@@ -55,26 +62,27 @@ The route must gather the following information:
5562

5663
How the user's unique ID is retrieved varies depending on how your app is built, but it is typically retrieved from a session cookie or other secure storage. It **must** match the user ID that your code specified at the start of the authorization flow.
5764

58-
5965
### Verify the user's identity
6066

6167
Use the Arcade SDK (or our REST API) to verify the user's identity.
6268

6369
<Callout type="warning">
64-
Because this request uses your Arcade API key, it *must not* be made from the client side (a browser or desktop app). This code must be run on a server.
70+
Because this request uses your Arcade API key, it *must not* be made from the
71+
client side (a browser or desktop app). This code must be run on a server.
6572
</Callout>
6673

6774
<Tabs items={["JavaScript","Python","REST"]} storageKey="preferredLanguage">
6875
<Tabs.Tab>
76+
6977
```ts {13-16}
70-
import { Arcade } from '@arcadeai/arcadejs';
78+
import { Arcade } from "@arcadeai/arcadejs";
7179

7280
const client = new Arcade(); // Looks for process.env.ARCADE_API_KEY by default
7381

7482
// Within a server GET handler:
7583
// Validate required parameters
7684
if (!flow_id) {
77-
throw new Error('Missing required parameters: flow_id');
85+
throw new Error("Missing required parameters: flow_id");
7886
}
7987

8088
// Confirm the user's identity
@@ -84,16 +92,24 @@ try {
8492
user_id: user_id_from_your_app_session, // Replace with the user's ID
8593
});
8694
} catch (error) {
87-
console.error('Error during verification', 'status code:', error.status, 'data:', error.data);
95+
console.error(
96+
"Error during verification",
97+
"status code:",
98+
error.status,
99+
"data:",
100+
error.data
101+
);
88102
throw error;
89103
}
90104
```
105+
91106
</Tabs.Tab>
92107
<Tabs.Tab>
108+
93109
```python {12-15}
94110
from arcadepy import AsyncArcade
95111

96-
client = AsyncArcade() # Looks for ARCADE_API_KEY environment variable by default
112+
client = AsyncArcade() # Looks for ARCADE_API_KEY environment variable by default
97113

98114
# Within a server GET handler:
99115
# Validate required parameters
@@ -104,14 +120,16 @@ if not flow_id:
104120
try:
105121
result = await client.auth.confirm_user(
106122
flow_id=flow_id,
107-
user_id=user_id_from_your_app_session, # Replace with the user's ID
123+
user_id=user_id_from_your_app_session, # Replace with the user's ID
108124
)
109125
except Exception as error:
110126
print("Error during verification:", error)
111127
raise Exception("Failed to verify the request")
112128
```
129+
113130
</Tabs.Tab>
114131
<Tabs.Tab>
132+
115133
```text
116134
POST https://cloud.arcade.dev/api/v1/oauth/confirm_user
117135
Authorization: Bearer <arcade_api_key>
@@ -121,7 +139,9 @@ Content-Type: application/json
121139
"flow_id": "<flow_id from the query string>",
122140
"user_id": "<the current user's ID>"
123141
}
142+
124143
```
144+
125145
</Tabs.Tab>
126146
</Tabs>
127147

@@ -133,9 +153,9 @@ If the user's ID matches the ID specified at the start of the authorization flow
133153
- Redirect to a different route in your application
134154
- Look up the auth flow's status in the Arcade API and render a success page
135155

136-
137156
<Tabs items={["JavaScript","Python","REST"]} storageKey="preferredLanguage">
138157
<Tabs.Tab>
158+
139159
```ts
140160
// Either redirect to result.next_uri, or render a success page:
141161
const authResponse = await client.auth.waitForCompletion(result.auth_id);
@@ -146,8 +166,10 @@ if (authResponse.status === "completed") {
146166
return "Something went wrong. Please try again.";
147167
}
148168
```
169+
149170
</Tabs.Tab>
150171
<Tabs.Tab>
172+
151173
```python
152174
# Either redirect to result.next_uri, or render a success page:
153175
auth_response = await client.auth.wait_for_completion(result.auth_id)
@@ -157,8 +179,10 @@ if auth_response.status == "completed":
157179
else:
158180
return "Something went wrong. Please try again."
159181
```
182+
160183
</Tabs.Tab>
161184
<Tabs.Tab>
185+
162186
```text
163187
HTTP 200 OK
164188
Content-Type: application/json
@@ -170,29 +194,41 @@ Content-Type: application/json
170194
// Optional: URL to redirect the user to after the authorization flow is complete
171195
"next_uri": "https://..."
172196
}
197+
173198
```
199+
174200
</Tabs.Tab>
175201
</Tabs>
176202

177-
178203
**Invalid Response**
179204

180205
If the user's ID does not match the ID specified at the start of the authorization flow, the response will contain an error.
181206

182207
<Tabs items={["JavaScript","Python","REST"]} storageKey="preferredLanguage">
183208
<Tabs.Tab>
209+
184210
```ts
185-
console.error('Error during verification', 'status code:', error.status, 'data:', error.data);
211+
console.error(
212+
"Error during verification",
213+
"status code:",
214+
error.status,
215+
"data:",
216+
error.data
217+
);
186218
throw error;
187219
```
220+
188221
</Tabs.Tab>
189222
<Tabs.Tab>
223+
190224
```python
191225
print("Error during verification:", error)
192226
raise Exception("Failed to verify the request")
193227
```
228+
194229
</Tabs.Tab>
195230
<Tabs.Tab>
231+
196232
```text
197233
HTTP 400 Bad Request
198234
Content-Type: application/json
@@ -202,18 +238,25 @@ Content-Type: application/json
202238
"msg": "An error occurred during verification"
203239
}
204240
```
241+
205242
</Tabs.Tab>
206243
</Tabs>
207244

208245
### Add your custom verifier route to Arcade
209246

210247
In the [Auth > Settings section](https://api.arcade.dev/dashboard/auth/settings) of the Arcade Dashboard, pick the **Custom verifier** option and add the URL of your verifier route.
211248

212-
<img src="/images/docs/auth/dashboard-custom-verifier.png" alt="An image showing how to pick the custom verifier option in the Arcade Dashboard" className="rounded-sm shadow-md" width="600" />
249+
<img
250+
src="/images/docs/auth/dashboard-custom-verifier.png"
251+
alt="An image showing how to pick the custom verifier option in the Arcade Dashboard"
252+
className="rounded-sm shadow-md"
253+
width="600"
254+
/>
213255

214256
<Callout type="info">
215257
Arcade's default OAuth apps *only* support the Arcade user verifier.
216-
Authorization flows using Arcade's default OAuth apps will use the Arcade user verifier even if you have a custom verifier route set up.
258+
Authorization flows using Arcade's default OAuth apps will use the Arcade user
259+
verifier even if you have a custom verifier route set up.
217260
</Callout>
218261

219262
</Steps>

0 commit comments

Comments
 (0)