Social Media OAuth - adding callbacks by code

Question

My question is quite simple, if you want to integrate social media oauth 2.0 you have to add the callbacks to an application for that specific social media platform such as FB/LinkedIn. Afaik, there's no way to add these callbacks through an API of some sort, correct? Meaning that if I want to add say a 100 callback links to fb, I'd have to add them manually?

Answer 1

To my knowledge, you're correct; it would be a manual process. There are a few specifications that would allow a more programmatic control of this registration information, but the specific provider you wanted to use would have to support them or a custom approach and again I don't think Facebook does it. For reference purposes:

• OAuth 2.0 Dynamic Client Registration Protocol
• OAuth 2.0 Dynamic Client Registration Management Protocol

---

Another possibility would be to go through a mediator that integrates with the providers you need to support and that can act as a provider on his own and at the same time allows you to configure the redirects in a programmatic way.

Diclosure: I'm an Auth0 engineer.

An example of this, would be Auth0; it integrates with Facebook and LinkedIn, but then allows your custom application to talk directly with Auth0. The benefit is that you configure Facebook and LinkedIn integration once with a single redirect URL and then can use that configuration acroos multiple applications.

Since Auth0 exposes OAuth2/OIDC endpoints you would still talk the same protocols but could now leverage Auth0 Management API to perform programmatic administration of the OAuth2 client application registration information; including the dynamic registration of redirect URL's. If you use FB or LinkedIn purely from an authentication standpoint this is a real straightforward approach to achieve your requirements. If your required the access tokens from FB to then make calls to their API on behalf of the user, although still possible with Auth0, you have a bit of overhead as these tokens would not be automatically available to your custom applications.