OAuth for user specific access tokens

[Krushnali_Tiwari]

Hello Samsung community, how can below usecase be realized?
Usecase - control multiple users’ smart devices (device added on smartThings app).

There is a client side application where user signs in using their samsung account. After authorization the user can simply control their smart devices.

Technically - after user authorization though OAuth2.0 authorization code flow the user access token will be provided to the client. This accesstoken is further used to make SmartThings API calls or invoke smartThings core sdk functions.

Note: use should register their smart devices on smartThings app.

[nayelyz (SmartThings Developer Support)]

Hi, @Krushnali_Tiwari

I saw your message and other replies in old posts, so, I’ll share with you the info here:

1. The option to create OAuth integrations cannot be found in the Developer Workspace.
2. You need to use the SmartThings CLI to create this type of app

Command:
smartthings apps:create
---->The type you need to select is “OAuth-In App”
----> Target URL is the link where you want to receive the subscription events
----> These scopes are the permissions whitelisted from your app, if you use a scope in the “authorize URL” not included in your app’s scopes, you’ll get an error
-----> Add redirect URI because that’s where you’ll receive the authorization code once the user authorizes access to your app.3. 4.

4. You can also use the JSON in this sample as the input for the command.
   GitHub - SmartThingsCommunity/api-app-subscription-example-js: Example API Access SmartApp that shows the state and allows control of devices
5. Then, you need to start the OAuth 2.0 process which consists on:

1. Show the authorization page to the user by using this URL:
   https://api.smartthings.com/oauth/authorize?client_id=${clientId_from_app}&response_type=code&redirect_uri=${redirect_uri_from_app}&scope=${scopes_from_whitelisted_inApp}
2. Once the user authorizes access to your app, it’ll redirect you to the “Redirect URI” you configured with the Authorization Code.
3. You’ll exchange this code with an Access Token. This is an example of that request:
   curl -X POST "https://api.smartthings.com/oauth/token" -u "${clientId_from_app}":"${clientSecret_from_app}" -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=authorization_code&client_id=${clientId_from_app}&code=${codeReceived}&redirect_uri=${redirect_uri_from_app}"

6. The Access Token you get expires in 24 hours.
7. The Refresh Token expires in 29 days if not used. We suggest you refresh the token before this time, otherwise, the User will need to re-authorize.

NOTE: Remember the OAuth integration has a limit of 500 installations by default. Each time a user authorizes access to one of his/her locations, it will count as 1 installation. This means, if a user has 3 locations and authorizes access to each of them, he/she will use 3 installations.

Please, let me know if you have questions about this.

[Krushnali_Tiwari]

Thankyou @nayelyz without your support it would have been hard.

[Krushnali_Tiwari]

Ms @nayelyz,

What do you think about this

Device events and OAuth-In App

Hello SmartThings community, Scenario: When my home door opens, The user should be notified on 3p client app. Can my OAuth-In App get notified of device events (for every user)? May be if i provide targer URI? Can it be done? I saw the Subscription apis but they require InstalledApp id. When a user signs in and access_token is generated it is equivalent to a smartApp installation. So it must have an installedApp id. I was considering this but i dont get any information (installedApp info) on ‘List Installed Apps’. Can you confirm - ‘Subscription APIs can be used for OAuth-In App’?

[Krushnali_Tiwari]

Is there a scope to get user account details (email id) along with the authorization code after authorization?

[nayelyz (SmartThings Developer Support)]

No, sorry. Due to Privacy policies, we cannot get that kind of information from users from the API.
But, the installedAppId is unique for each instance, so if you have an internal Login, you can associate a user with their corresponding IDs.

[Krushnali_Tiwari]

Hi @nayelyz i have have used OAuth In App for now. But if i want to use this in production are there some procedures, aggreements or sort i have to go through with SmartThings?