1ToolRing supports Google and GitHub OAuth for account creation and sign-in.

Flow

1. The dashboard links to /auth/google or /auth/github on the API host.
2. The provider authorizes and redirects back to /auth/{provider}/callback on the API host.
3. The backend validates the state, fetches the verified profile, upserts the user, and redirects to the dashboard with a JWT in the URL fragment:

https://app.1toolring.com/oauth/callback#token=<jwt>

Requirements

• Google: the account must return a verified email.
• GitHub: the user must have a primary verified email and grant the read:user user:email scope.

Security

• The OAuth state is a signed cookie (HttpOnly, Secure, SameSite=Lax, 10-minute TTL).
• A new OAuth user is created with email_verified = true, so the signup bonus is granted at creation.
• Suspended accounts are rejected at login.