{"action":"opened","issue":{"url":"https://api.github.com/repos/idno/Known/issues/1504","repository_url":"https://api.github.com/repos/idno/Known","labels_url":"https://api.github.com/repos/idno/Known/issues/1504/labels{/name}","comments_url":"https://api.github.com/repos/idno/Known/issues/1504/comments","events_url":"https://api.github.com/repos/idno/Known/issues/1504/events","html_url":"https://github.com/idno/Known/issues/1504","id":175606386,"number":1504,"title":"IndieAuth: authentication token removed too early","user":{"login":"cweiske","id":59036,"avatar_url":"https://avatars.githubusercontent.com/u/59036?v=3","gravatar_id":"","url":"https://api.github.com/users/cweiske","html_url":"https://github.com/cweiske","followers_url":"https://api.github.com/users/cweiske/followers","following_url":"https://api.github.com/users/cweiske/following{/other_user}","gists_url":"https://api.github.com/users/cweiske/gists{/gist_id}","starred_url":"https://api.github.com/users/cweiske/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cweiske/subscriptions","organizations_url":"https://api.github.com/users/cweiske/orgs","repos_url":"https://api.github.com/users/cweiske/repos","events_url":"https://api.github.com/users/cweiske/events{/privacy}","received_events_url":"https://api.github.com/users/cweiske/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-07T21:05:37Z","updated_at":"2016-09-07T21:05:37Z","closed_at":null,"body":"## While trying to do this:\r\nConnect my micropub client to my local known instance\r\n\r\n## I encountered this error:\r\nMicropub client says:\r\n```\r\nFailed to fetch access token\r\nServer responded with HTTP status code 400\r\nunrecognized code.\r\n```\r\n\r\n## Some other notes:\r\nKnown invalidates the authentication code immediately when it has been used once.\r\nThis is correct for authentication requests, but not for authorization requests.\r\n\r\nFor authorization, the process is the following:\r\n\r\n1. Start indieauth login process by redirecting the user to the known instance with a callback URL\r\n2. known redirects to client with a code\r\n3. client verifies the auth code and the \"me\" value by POSTing to the indieauth endpoint (known invalidates the code here)\r\n4. client fetches access token by POSTing to the token endpoint, using the same auth code.\r\n\r\nAt 4 it fails because known already invalidated the auth code in step 3.\r\n"}}
{"actor":{"display_login":"cweiske"}}