ProID

Nima uchun ProID?

Foydalanuvchi bir marta ProID’da autentifikatsiya qiladi va sizning xizmatingizga parolsiz, xavfsiz kiradi. Siz parol saqlamaysiz, SMS/OTP infratuzilmasini qurmaysiz — hammasini ProID bajaradi.

Xavfsiz

OAuth 2.0 + bir martalik authorization_code. Parollar sizning tomoningizda saqlanmaydi, client_secret faqat backend’da qoladi.

Tezkor

3 qadamlik oqim: authorize → token → user. Bir necha soatda integratsiya.

SSO

Bitta hisob bilan bir nechta xizmatga kirish. Foydalanuvchi bir marta kiradi, hamma joyda tanaladi.

Mahalliy

O’zbekiston uchun: 998 telefon formati, MyID va operator SMS integratsiyasi.

Qanday ishlaydi?

1. Authorize — foydalanuvchini ProID sahifasiga yo’naltirasiz, u kirib ruxsat beradi.

2. Token — qaytgan code ni backend’da client_secret bilan access_token ga almashtirasiz.

3. User — access_token bilan foydalanuvchi ma’lumotini olasiz.

1. Kirish (frontend)

login.js

// 1-qadam — Foydalanuvchini ProID authorize sahifasiga yo'naltirish
function loginWithProID() {
  const clientId = "YOUR_CLIENT_ID";
  const redirectUri = "https://yourapp.com/callback";

  const authUrl = new URL("https://id.sfere.pro/oauth");
  authUrl.searchParams.set("client_id", clientId);
  authUrl.searchParams.set("redirect_uri", redirectUri);
  authUrl.searchParams.set("response_type", "code");

  // Brauzerni ProID sahifasiga yo'naltiramiz
  window.location.href = authUrl.toString();
}

document.getElementById("login-btn").addEventListener("click", loginWithProID);

2. Token (backend)

token.js

// 2-qadam — authorization code ni access token ga almashtirish
// DIQQAT: bu so'rov faqat backend'da bajarilsin — client_secret hech qachon
// brauzerga chiqmasligi kerak.
async function exchangeCodeForToken(authCode) {
  const tokenUrl = "https://api.id.sfere.pro/api/v2/oauth/token";

  const body = new URLSearchParams({
    grant_type: "authorization_code",
    client_id: "YOUR_CLIENT_ID",
    client_secret: "YOUR_CLIENT_SECRET",
    // redirect_uri authorize paytidagi qiymat bilan AYNAN bir xil bo'lishi shart
    redirect_uri: "https://yourapp.com/callback",
    code: authCode,
  });

  const response = await fetch(tokenUrl, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body,
  });

  if (!response.ok) {
    throw new Error("Token olishda xatolik: " + response.status);
  }

  const data = await response.json();
  // { token_type: "Bearer", expires_in: 864000, access_token: "..." }
  return data.access_token;
}

To'liq misol (Node.js)

oauth.js

// To'liq backend misoli (Node.js + Express)
// Callback -> token almashtirish -> foydalanuvchi ma'lumotini olish
const express = require("express");
const axios = require("axios");

const app = express();

const CLIENT_ID = process.env.PROID_CLIENT_ID;
const CLIENT_SECRET = process.env.PROID_CLIENT_SECRET;
const REDIRECT_URI = "https://yourapp.com/callback";

app.get("/callback", async (req, res) => {
  const code = req.query.code;
  if (!code) return res.status(400).json({ error: "code topilmadi" });

  try {
    // 1) code -> access_token
    const tokenRes = await axios.post(
      "https://api.id.sfere.pro/api/v2/oauth/token",
      new URLSearchParams({
        grant_type: "authorization_code",
        client_id: CLIENT_ID,
        client_secret: CLIENT_SECRET,
        redirect_uri: REDIRECT_URI,
        code,
      }),
      { headers: { "Content-Type": "application/x-www-form-urlencoded" } }
    );

    const accessToken = tokenRes.data.access_token;

    // 2) access_token -> foydalanuvchi ma'lumoti
    const userRes = await axios.get("https://api.id.sfere.pro/api/user", {
      headers: { Authorization: `Bearer ${accessToken}` },
    });

    // Bu yerda o'z tizimingizda sessiya yarating / userni saqlang
    res.json({ user: userRes.data });
  } catch (err) {
    res.status(400).json({ error: "OAuth jarayonida xatolik" });
  }
});

app.listen(3000, () => console.log("OAuth server 3000-portda"));

client_secret ni himoya qiling

client_secret va token almashinuvi faqat backend’da bajarilishi kerak. Uni hech qachon brauzer/mobil ilova koddiga joylashtirmang.

Keyingi qadam

Tez start 5 daqiqada birinchi muvaffaqiyatli login.

OAuth 2.0 qo'llanmasi To'liq integratsiya: authorize, token, callback.

API Reference Endpointlar, parametrlar, so'rov va javob namunalari.

Xavfsizlik redirect_uri, rate limit va best practice.