OAuth 2.0 qo'llanmasi

Bu qo’llanma ProID bilan authorization_code oqimini boshidan oxirigacha yig’ib beradi. Umumiy oqim:

Foydalanuvchi ──▶ ProID authorize ──▶ redirect_uri?code=... ──▶ (backend) token ──▶ user

Oldindan kerak bo’ladi

Nima	Qayerdan
client_id	PRO GROUP Manager
client_secret	PRO GROUP Manager (maxfiy)
redirect_uri	Siz belgilaysiz, Manager ro’yxatdan o’tkazadi

1. Ilovani ro’yxatdan o’tkazing

   client_id, client_secret olish va callback (redirect_uri) manzilingizni ro’yxatdan o’tkazish uchun menejerga murojaat qiling:

   PRO GROUP Manager →

   redirect_uri qat'iy tekshiriladi

   Menejerga bergan redirect_uri ProID tomonida saqlanadi. Authorize va token bosqichlarida yuborgan redirect_uri aynan shu qiymatga mos kelishi shart — aks holda so’rov rad etiladi (redirect_uri mismatch).

2. Foydalanuvchini authorize sahifasiga yo’naltiring

   Brauzerni quyidagi manzilga yo’naltiring (GET):

   https://id.sfere.pro/oauth?client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_REDIRECT_URI&response_type=code

   Parametr	Majburiy	Tavsif
   client_id	✅	Manager bergan Client ID
   redirect_uri	✅	Ro’yxatdan o’tgan callback manzili (URL-encoded)
   response_type	✅	Har doim code

   Misol:

   https://id.sfere.pro/oauth?client_id=55&redirect_uri=https%3A%2F%2Fyourapp.com%2Fcallback&response_type=code

   Foydalanuvchi ProID sahifasida kiradi:

   

   So’ng kirmoqchi bo’lgan hisobini tanlaydi:

   

3. Callback orqali code ni qabul qiling

   Foydalanuvchi ruxsat bergach, ProID sizning redirect_uriingizga code query parametri bilan qaytadi:

   

   https://yourapp.com/callback?code=SIZNING_CODE

   Note

   code bir martalik va qisqa muddatli (~10 daqiqa). Uni darhol keyingi qadamda access token’ga almashtiring.

4. code ni access token’ga almashtiring

   Bu so’rov backend’da bajariladi (client_secret maxfiy).

   Endpoint: POST https://api.id.sfere.pro/api/v2/oauth/token

   Parametr	Type	Tavsif
   grant_type	string	Har doim authorization_code
   client_id	string	Client ID
   client_secret	string	Client Secret
   redirect_uri	string	Authorize’dagi bilan aynan bir xil
   code	string	Callback’dan olingan kod

   cURL

   curl -X POST 'https://api.id.sfere.pro/api/v2/oauth/token' \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'grant_type=authorization_code' \
     --data-urlencode 'client_id=YOUR_CLIENT_ID' \
     --data-urlencode 'client_secret=YOUR_CLIENT_SECRET' \
     --data-urlencode 'redirect_uri=YOUR_REDIRECT_URI' \
     --data-urlencode 'code=YOUR_CODE'

   Node.js

   const res = await fetch("https://api.id.sfere.pro/api/v2/oauth/token", {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       grant_type: "authorization_code",
       client_id: process.env.PROID_CLIENT_ID,
       client_secret: process.env.PROID_CLIENT_SECRET,
       redirect_uri: "https://yourapp.com/callback",
       code,
     }),
   });
   const { access_token } = await res.json();

   PHP

   $res = Http::asForm()->post('https://api.id.sfere.pro/api/v2/oauth/token', [
       'grant_type'    => 'authorization_code',
       'client_id'     => env('PROID_CLIENT_ID'),
       'client_secret' => env('PROID_CLIENT_SECRET'),
       'redirect_uri'  => 'https://yourapp.com/callback',
       'code'          => $code,
   ]);
   $accessToken = $res->json('access_token');

   Javob (200 OK):

   {
     "token_type": "Bearer",
     "expires_in": 864000,
     "access_token": "42|Xr8kQ...token..."
   }

5. Foydalanuvchi ma’lumotini oling

   Endpoint: GET https://api.id.sfere.pro/api/user

   curl 'https://api.id.sfere.pro/api/user' \
     -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

   Javob (200 OK):

   {
     "id": 128,
     "name": "Ali",
     "surname": "Valiyev",
     "phone_number": "998991234567",
     "email": "ali@example.com",
     "avatar_full_url": "https://api.id.sfere.pro/storage/avatars/abc.png",
     "date_of_birth": "1998-05-12",
     "gender": "male",
     "avatar": "https://api.id.sfere.pro/storage/avatars/abc.png",
     "is_admin": 0
   }

Tayyor!

Endi access_token va foydalanuvchi ma’lumoti bilan o’z tizimingizda sessiya yaratasiz. access_token ~10 kun (expires_in: 864000 soniya) amal qiladi.

API Reference Barcha endpoint, parametr va javoblar ro'yxati.

Xatoliklarni hal qilish redirect_uri mismatch, invalid code, 429 va boshqalar.