From 60f6989595e35ba3aa91b4656ca0567c62658fed Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Thu, 26 Feb 2026 11:47:15 +0000 Subject: [PATCH] docs: add userinfo 429 backoff guidance Extend integration guidance to cover provider-side abuse controls on userinfo lookups, advising retry/backoff handling for 429 responses. --- docs/INTEGRATION_GUIDE.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/INTEGRATION_GUIDE.md b/docs/INTEGRATION_GUIDE.md index c2b2c2d..ec89778 100644 --- a/docs/INTEGRATION_GUIDE.md +++ b/docs/INTEGRATION_GUIDE.md @@ -139,6 +139,7 @@ try { - Keep provider URLs in environment variables, not hard-coded. - Avoid printing tokens in production pages. - Expect `429 Too Many Requests` from provider control endpoints under abuse protection; implement backoff/retry instead of tight loops. +- Apply the same backoff strategy for provider `userinfo` calls that return `429 Too Many Requests`. - If you call provider WebAuthn login challenge/verify endpoints directly, use `POST` only. - Configure OAuth client redirect URIs as HTTPS in production; reserve HTTP for localhost loopback testing only. - Rotate client secrets for confidential clients.