Plex OAuth uses polling instead of redirect flow

[powerje]

Current Implementation

The application uses PIN polling with 5-second intervals for Plex authentication.

Root Cause

Plex broke OAuth for 3rd party applications in Web update v4.152.0 (September 2025). The recommended forwardUrl redirect flow no longer works due to Cross-Origin-Opener-Policy changes.

Forum Thread: https://forums.plex.tv/t/plex-oauth-authenticate-with-plex-broken-after-plex-web-update-v4-152-0/931098

Current Limitations

• Slower authentication (5-second polling vs instant redirect)
• Risk of rate limiting with aggressive testing
• Manual retry required if rate limited

TODO

Switch back to forwardUrl redirect flow once Plex fixes their OAuth implementation. This is the proper authentication method for web applications.

Code Location

internal/handlers/auth.go (Login handler with JavaScript polling)