benos-auth

Static OAuth callback pages for BenOS connectors.

Some OAuth providers refuse loopback redirect URIs. Withings, for example, requires every registered redirect_uri to start with https, use port 80 or 443, contain no IP address or localhost, and answer an HTTP HEAD verification request. That rules out the ephemeral http://127.0.0.1:<port>/callback listener the benos auth command normally binds.

These pages are the workaround. Each one reads the authorization code out of its own query string and renders it for copying into the terminal, where the local CLI exchanges it for tokens.

Why it is safe to share one URL across all users

The pages are pure static HTML with no backend. They hold no client secret, set no cookies, and transmit nothing — the code is read from location.search by client-side JavaScript and displayed. An authorization code is single-use, short-lived, and worthless without the client secret, which never leaves the user's machine.

So every BenOS user can register the same callback URL in their own provider app. That matters: without it, each user would have to stand up their own public HTTPS host before they could authorize a connector at all.

Pages

Path	Provider
/withings/	Withings Health Data API

Registering

Use the full page URL, including the trailing slash:

https://bgalbs.github.io/benos-auth/withings/