You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<!-- If this pull request closes an issue, please mention the issue
number below -->
Closes # <!-- Issue # here -->
## 💸 TL;DR
<!-- What's the three sentence summary of purpose of the PR -->
## 📜 Details
[Design Doc](<!-- insert Google Doc link here if applicable -->)
[Jira](<!-- insert Jira link if applicable -->)
<!-- Add additional details required for the PR: breaking changes,
screenshots, external dependency changes -->
## 🧪 Testing Steps / Validation
<!-- add details on how this PR has been tested, include reproductions
and screenshots where applicable -->
## ✅ Checks
<!-- Make sure your pr passes the CI checks and do check the following
fields as needed - -->
- [ ] CI tests (if present) are passing
- [ ] Adheres to code style for repo
- [ ] Contributor License Agreement (CLA) completed if not a Reddit
employee
External endpoints provide a secure way for external services to communicate with your Devvit app.
3
+
External endpoints provide a secure way for external services to communicate with your Devvit app.
4
4
5
5
:::note
6
-
This is a limited-access feature. Fill out this \[form\](https://docs.google.com/forms/d/e/1FAIpQLScLU2m-IH9xtt4hqFBNy5AlrswY0pvfvoyTiQREbq\_9xDQJkQ/viewform) to request access.
6
+
This is a limited-access feature. Fill out this [form](https://docs.google.com/forms/d/e/1FAIpQLScLU2m-IH9xtt4hqFBNy5AlrswY0pvfvoyTiQREbq_9xDQJkQ/viewform) to request access.
7
7
:::
8
8
9
9
The term **endpoint** refers to externally accessible routes exposed by your app. This consistent terminology makes it easier to identify the relevant APIs, configuration, and code paths.
| Callback tokens | Your app initiates work and an external service returns a result later | Short-lived, one-time callback token generated automatically |
16
-
| Managed tokens | An external service initiates requests to your app | Long-lived token managed in Developer Settings |
16
+
| Managed tokens | An external service initiates requests to your app | Long-lived token managed in Developer Settings|
17
17
18
18
All tokens start with `devvit_at_`.
19
19
20
20
Tokens are secret. Never share a token or a callback URL.
21
21
22
22
Never call an `/external/` endpoint from a Devvit app’s frontend. All external endpoints require a secret token to access which cannot easily be hidden in a post. Call conventional `/api/` endpoints instead. External endpoints are for trusted services only.
23
23
24
-
## **Declaring external endpoints**
24
+
## Declaring external endpoints
25
25
26
26
External endpoints are declared in `devvit.json`.
27
27
@@ -41,18 +41,18 @@ The key becomes the endpoint name used throughout the codebase, while the value
41
41
42
42
External endpoints can receive request bodies up to 10 megabytes, and are limited to 5 requests per second (at time of writing, may change at any time).
43
43
44
-
## **Callbacks**
44
+
## Callbacks
45
45
46
-
Callbacks allow your Devvit app to generate authenticated URLs that external services can use to call *back* into the app.
46
+
Callbacks allow your Devvit app to generate authenticated URLs that external services can use to call _back_ into the app.
47
47
48
48
These URLs contain short-lived authentication tokens generated at runtime. You can think of Callbacks as similar to passwordless login links ("magic links") used by services such as Slack.
49
49
50
50
Typical flow:
51
51
52
-
1. Your app generates a callback URL.
53
-
2. Your app sends that URL to an external service.
54
-
3. The external service performs work.
55
-
4. The external service invokes the callback URL.
52
+
1. Your app generates a callback URL.
53
+
2. Your app sends that URL to an external service.
All `Context` is recorded at `getCallbackUrl()` invocation time and restored when handling an external request.
167
164
168
-
## **Managed tokens**
165
+
## Managed tokens
169
166
170
167
Managed tokens are long-lived credentials that allow an external service to invoke endpoints exposed by your Devvit app. Unlike callbacks, managed tokens do not require a request to originate from your app.
171
168
172
-
Managed tokens are:
169
+
Managed tokens are:
173
170
174
-
* Created and managed in Developer Settings of your app
175
-
* Have a user-defined name
176
-
* Consist of:
177
-
* A public token ID
178
-
* A private secret
179
-
* Long-lived
180
-
* Currently scoped globally across all installations of an app
181
-
* All requests execute as the app account
182
-
* Can be revoked at any time
171
+
- Created and managed in Developer Settings of your app
172
+
- Have a user-defined name
173
+
- Consist of:
174
+
- A public token ID
175
+
- A private secret
176
+
- Long-lived
177
+
- Currently scoped globally across all installations of an app
* The secret token is displayed only once, at creation time.
196
-
* Store the secret securely. If you use the token in a Devvit app, use a [`secret setting`](https://developers.reddit.com/docs/capabilities/server/settings-and-secrets). Many apps won’t need to store the secret as it’s the calling external service that needs to send it.
197
-
* Never expose tokens to anyone.
198
-
* The secret token must be provided in the `Authorization` header for incoming external requests to the app.
192
+
- The secret token is displayed only once, at creation time.
193
+
- Store the secret securely. If you use the token in a Devvit app, use a [`secret setting`](https://developers.reddit.com/docs/capabilities/server/settings-and-secrets). Many apps won’t need to store the secret as it’s the calling external service that needs to send it.
194
+
- Never expose tokens to anyone.
195
+
- The secret token must be provided in the `Authorization` header for incoming external requests to the app.
199
196
200
197
Example:
201
198
@@ -221,10 +218,10 @@ if (!rsp.ok) {
221
218
222
219
### Creating a managed token
223
220
224
-
1. Open the Developer Portal.
225
-
2. Navigate to Developer Settings for your app.
226
-
3. Create a new App Token.
227
-
4. Copy and securely store the generated private secret.
221
+
1. Open the Developer Portal.
222
+
2. Navigate to Developer Settings for your app.
223
+
3. Create a new App Token.
224
+
4. Copy and securely store the generated private secret.
228
225
5. The secret will only be shown once. If you lose it, revoke the token and create a new one.
229
226
230
227
### Scope
@@ -239,21 +236,21 @@ https://${appSlug}-bbb456-external.devvit.net/external/on/image/generated // sub
239
236
https://${appSlug}-ccc789-external.devvit.net/external/on/image/generated // sub C
240
237
```
241
238
242
-
This is a powerful and potentially problematic feature because it allows an app to expose endpoints that can be accessed from outside the platform. Moderators should carefully evaluate apps that have external endpoints capability and ensure they come from trusted sources.
239
+
This is a powerful and potentially problematic feature because it allows an app to expose endpoints that can be accessed from outside the platform. Moderators should carefully evaluate apps that have external endpoints capability and ensure they come from trusted sources.
243
240
244
-
To help mods evaluate your app, document each external endpoint clearly, and only expose endpoints that are necessary for your app’s functionality.
241
+
To help mods evaluate your app, document each external endpoint clearly, and only expose endpoints that are necessary for your app’s functionality.
245
242
246
-
## **Choosing between callbacks and managed tokens**
243
+
## Choosing between callbacks and managed tokens
247
244
248
245
Use **callback tokens** when your app initiates a workflow and needs a secure way for an external service to return a result with the same context.
249
246
250
247
Use **managed tokens** when an external service needs ongoing access to invoke your app's external endpoints.
251
248
252
-
| Use Case | Callback Token | Managed Tokens |
253
-
| ----- | :---: | :---: |
254
-
| App initiates work in an external service |✅ | ❌|
0 commit comments