andy/blackwall-auth-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

docs: note 429 backoff expectations for provider control endpoints

Browse Source 
Document that integrations should expect provider-side abuse controls on OAuth control endpoints and handle 429 responses with retry/backoff semantics.
This commit is contained in:
Andy Dixon
2026-02-26 11:38:56 +00:00
parent d8a28dea12
commit 44aa9e6f80
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/INTEGRATION_GUIDE.md
+1
View File
@@ -138,6 +138,7 @@ try {
- Keep provider URLs in environment variables, not hard-coded. - Keep provider URLs in environment variables, not hard-coded.
- Avoid printing tokens in production pages. - Avoid printing tokens in production pages.
- Expect `429 Too Many Requests` from provider control endpoints under abuse protection; implement backoff/retry instead of tight loops.
- Rotate client secrets for confidential clients. - Rotate client secrets for confidential clients.
- Add a unique `nonce` to each OIDC authorisation request. - Add a unique `nonce` to each OIDC authorisation request.
- Validate `state` on every callback request. - Validate `state` on every callback request.