[DEVECO-1007] Document Public Scoped Apps (Early Access) - #144
Draft
gaberduty wants to merge 1 commit into
Draft
Conversation
Add an Early Access page for developers trying out Public Scoped Apps,
which extend Scoped OAuth so a single app can be used across many
PagerDuty accounts.
The page covers the two constraints that distinguish it from a normal
Scoped app:
- Cross-account access is limited to user tokens. The client
credentials flow still only issues an app token for the account that
created the app, so any app-token-dependent behavior stays
single-account.
- A user can only authorize the app after an admin on their account
has installed it, via https://app.pagerduty.com/oauth_apps/[app_id].
Also notes that going public does not relax the confidential-client
requirement — a Scoped app must still secure its client_secret and use
PKCE — since "many accounts can use this" invites the wrong inference.
Left out of toc.json so the page is reachable but not advertised, as
with Early Access Webhooks. A screenshot of the admin installation page
is still to come, marked with a TODO.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DEVECO-1007
Adds an Early Access page for developers trying out Public Scoped Apps, which extend Scoped OAuth so a single app can be used across many PagerDuty accounts.
What the page covers
https://app.pagerduty.com/oauth_apps/[app_id].client_secretand use PKCE. Worth stating explicitly, since "many accounts can use this app" invites the wrong inference about distributing the secret.Notes for review
toc.json, so the page renders at its slug but isn't advertised in the sidebar — same treatment as20-Early-Access-Webhooks.md.<!-- TODO -->where it belongs.app.pagerduty.com. If EU accounts needeu.pagerduty.com/oauth_apps/[app_id], that needs a line.08-OAuth-Functionality.mdnow contradicts this page. Since [DEVECO-886] Consolidate User OAuth Token docs #143, line 42 leads with "It is limited to a single account" as the first of "Three things distinguish it from Classic User OAuth," and line 42 also says to use Classic User OAuth if you are building for many accounts. Both are wrong for EA participants. Deliberately untouched here, because that page is in the TOC and amending it would leak EA behavior to everyone — but at GA that framing collapses from three distinguishing things to two.🤖 Generated with Claude Code