@Chocobozzz Hey, so recently I received some issues for my native Peertube tvOS client, PeerTV, regarding an inability for them to login to their accounts on specific instances that require either OpenID or OAuth. I tried implementing that, but I found out that in order to use passkeys from the apple device I need to coordinate with specific instances and have the accept some sort of credential from my app (which seems rather difficult). I tried using only the user and password to sign in with SSO but there were challenges and it wasn’t consistently logging in the users.
Did you face a similar issue with the Peertube iOS app? Can you share what you were able to do to get that working (if it even works with SSO at all)?
Hi
You don’t implement OIDC/passkeys yourself. PeerTube does it in the browser and gives you a one-time externalAuthToken. You then exchange this at POST /api/v1/users/token, using grant_type=password + externalAuthToken instead of a password. That’s also why the username and password method was unreliable. SSO accounts have no local password.
This is how it works in our app:
From GET /api/v1/config, we read plugin.registeredExternalAuths to detect peertube-plugin-auth-openid-connect and grab its version.
We open the instance’s plugin auth URL in the system browser: https://{host}/plugins/auth-openid-connect/{version}/auth/openid-connect?externalRedirectUri=peertube://joinpeertube.org/openid-loading.
The browser handles all the SSO/passkeys/MFA. PeerTube then redirects back to our custom scheme: peertube://joinpeertube.org/openid-loading?externalAuthToken=XXX&username=YYY.
We catch that deep link, then do the GET /api/v1/oauth-clients/local + POST /api/v1/users/token exchange above to get normal access/refresh tokens.
The redirect URI is the one thing instances control: the plugin whitelists it via the allowed-external-redirect-uris setting (ours is \~^peertube://joinpeertube.org/.\*$).
