Tornevall Networks

← Back to docs

OAuth Endpoints

Language: EN | EN | SV

OAuth Endpoints

This page documents OAuth endpoints used by Tools web integrations.

Slack OAuth

Start OAuth flow

  • Route name: oauth.slack.start
  • Path: /oauth/slack/start
  • Method: GET or POST
  • Auth: auth:web

Starts the Slack OAuth flow and redirects to Slack oauth/v2/authorize.

OAuth callback

  • Route name: oauth.slack.callback
  • Path: /oauth/slack/callback
  • Method: GET
  • Auth: auth:web

Slack redirects back here with code and state.

Callback URL helper

  • Route name: oauth.slack.callback-url
  • Path: /oauth/slack/callback-url
  • Method: GET
  • Auth: auth:web

Returns the currently computed callback URL in JSON:

{
  "callback_url": "https://tools.tornevall.com/oauth/slack/callback"
}

SoundCloud OAuth

Start OAuth flow

  • Route name: oauth.soundcloud.start
  • Path: /oauth/soundcloud/start
  • Method: POST
  • Auth: auth:web

Expected payload:

{
  "provider_app_id": 1,
  "target_owner_type": "system",
  "target_owner_id": null
}

OAuth callback

  • Route name: oauth.soundcloud.callback
  • Path: /oauth/soundcloud/callback
  • Method: GET
  • Auth: auth:web

Receives provider callback values (state, code, error, error_description).

Microsoft To Do OAuth

Start OAuth flow

  • Route name: oauth.microsoft_todo.start
  • Path: /oauth/microsoft-todo/start
  • Method: POST
  • Auth: auth:web

Starts the Microsoft OAuth flow for the currently logged-in user.

OAuth callback

  • Route name: oauth.microsoft_todo.callback
  • Path: /oauth/microsoft-todo/callback
  • Method: GET
  • Auth: auth:web

Receives provider callback values (state, code, error, error_description) and stores the per-user Microsoft To Do connection.

X callback placeholder

The current X mention-bot does not complete a browser-based OAuth exchange. It still uses static server-side X_BOT_* credentials from .env.

If you receive X OAuth 2.0 client credentials during app setup, store them in:

  • X_OAUTH2_CLIENT_ID
  • X_OAUTH2_CLIENT_SECRET
  • optional X_OAUTH2_REDIRECT_URI

If the X dashboard also shows generated OAuth 2.0 user tokens, store them in:

  • X_OAUTH2_ACCESS_TOKEN
  • X_OAUTH2_REFRESH_TOKEN

Those are reserved for a future callback-driven OAuth2 flow and are separate from the current OAuth1-style posting credentials X_BOT_ACCESS_TOKEN and X_BOT_ACCESS_TOKEN_SECRET.

However, Tools now exposes a public callback placeholder so there is a real URL available for X app registration when a callback field is required:

Callback placeholder

  • Route name: oauth.x.callback
  • Path: /oauth/x/callback
  • Method: GET
  • Auth: public

This route currently acts as an informational landing page and placeholder only. It does not yet exchange or store X OAuth tokens.

Callback URL helper

  • Route name: oauth.x.callback-url
  • Path: /oauth/x/callback-url
  • Method: GET
  • Auth: public

Returns JSON containing the currently computed X callback URL.

Redirect URL guidance

For Slack app configuration, use:

  • Dev: https://tools.tornevall.com/oauth/slack/callback
  • Prod: https://tools.tornevall.net/oauth/slack/callback

If SLACK_REDIRECT_URI is configured, that value is used as the effective redirect URI and should be registered in Slack App settings.

For Microsoft To Do / Microsoft Graph app configuration, register the callback matching the current environment:

  • Dev: https://tools.tornevall.com/oauth/microsoft-todo/callback
  • Prod: https://tools.tornevall.net/oauth/microsoft-todo/callback

If MICROSOFT_TODO_REDIRECT_URI is configured, that value becomes the effective redirect URI and should be registered in the Microsoft Entra app as well.

For X app registration, if you need a callback URL field even though the current bot uses static credentials, use:

  • Dev: https://tools.tornevall.com/oauth/x/callback
  • Prod: https://tools.tornevall.net/oauth/x/callback

When the Microsoft To Do platform app is not environment-managed, the shared app settings can now also be saved from /settings/integrations/microsoft-todo by an acknowledged admin. The page shows the same recommended callback URL together with additive diagnostics about missing platform-app fields.