Any developers here interested in early access to an OAuth proxy service?
We have just oversimplified OAuth integration to service providers with https://pathfix.com.
In a nutshell, no more server modules needed to manage OAUTH Integrations
Happy to provide early private access to developers on IH.
Hey @sameerav,
How do you intent to build trust and demonstrate your have the right security measures in place? I think most developers would be weary to trust their OAuth tokens with an external proxy agent... especially a startup with no track record and little to no documentation on the entire thing.
If you think about it, you are offering a service in which if you can access the refresh and/or access tokens you can otherwise imitate any application and/or user that uses your service.
Have you thought about describing your trust model on your website and demonstrate how you have no direct access to the encrypted token store? Better yet, are you using some sort of HSM to store the tokens and a way to demonstrate how you audit and control it so no human has direct access to such information?
Without it, I know I wouldn’t even consider such a service. Then again, I’d just use Azure Active Directory backed with Azure KeyVault and protect the tokens myself.
Interesting product idea. I’d expect if you want to find PMF you are going to need to establish trust in your service early on. Hope you find it. Good luck!
Thanks @SilverStr I completely agree. Security is absolutely crucial to us! We encrypt all the tokens and keys before saving it, and yes no human would have access to it.
We are working on the content for the site that highlights this along with in-depth documentation. Additionally, we are also going to publish content that covers transport layer security implemented as well.
Thank you so much for the kind wishes, we are most certainly putting all our efforts towards security
Hi, thanks for the offer. I don't have a use case for this atm, but I did take a look at the website to understand the product better.
Is the ability to send messages (that are stamped with the access token) the main difference from e.g. Auth0 (that only offers authentication)?
How does the external API invocation get routed through Pathfix? Can I still use e.g. official client libraries, or do I have to assemble Pathfix-specific HTTP requests?
And by the way, you have a typo on the landing page at "Pathfix is the easiest way for you to authentication and authorization your users between applications" (for you to...)
hey @jki that's right. In addition to the authentication we also provide the ability to send messages that are stamped with the token.
Yes you would have to assemble 1 pathfix-specific HTTP request library. This will replace the multiple client sdk libraries (e.g. twitter sdk, slack sdk, trello sdk etc. are not needed)
However, while putting together the pathfix specific library, you can include only the calls you want to make in a standard format, eg.
`{, "instagram": [
{
name: "instagram_0",
label: "Get User Profile",
callData: {
url: "https://graph.instagram.com/me?fields=id,username",
method: "GET",
payload: {}
}
}
]
, "twitter": [
{
name: "twitter_0",
label: "Verify Credentials",
callData: {
url: "https://api.twitter.com/1.1/account/verify_credentials.json",
method: "GET",
payload: {}
If you view-source source of the page https://app.pathfix.com/page-sample and look for const methods = ... you will see an array which will be somewhat an example of functions you can expose through your pathfix-specific library
let me know your thoughts...