The 401 that never got to happen
A browser will not attach a bearer token to a page navigation. Swapping the header for a cookie the framework already understood, without weakening it.
Tags
3 pages
Auth
Desktop apps don't paste
TikTok's OAuth flow wants you to copy a code out of a web page and paste it into a terminal. What it took to give keryx a native flow instead.
Who holds the client secret?
When a desktop CLI posts on your behalf, the OAuth tutorial assumption of a server holding the client secret collapses. What replaces it.
