AucoBot OAuth Proxy

Pass-through OAuth service for self-hosted AucoBot. Deploy on Vercel (free tier OK).

• Does not persist refresh tokens long-term (Vercel KV TTL ~2 minutes for handoff only).
• Fixed callback URL for Google / GitHub OAuth apps.

Endpoints

Method	Path	Description
GET	/oauth/{provider}/start	Start OAuth (provider: google, github)
GET	/oauth/callback	Provider callback (register this URL)
POST	/api/complete	Exchange relay_code for tokens (server-to-server)
GET	/health	Health check

Local dev

cd oauth-proxy
cp .env.example .env
# Fill GOOGLE_* / GITHUB_* / RELAY_API_SECRET
npm install
npm run dev
# http://localhost:3090

Without Vercel KV env vars, uses in-memory store (fine for local dev).

Vercel deploy

1. Import repo / set root directory to oauth-proxy
2. Add Vercel KV storage → binds KV_REST_API_URL / KV_REST_API_TOKEN
3. Set environment variables from .env.example
4. Custom domain: oauth.aucobot.com

Google Cloud (one-time)

1. Create OAuth Web application
2. Authorized redirect URI: https://oauth.aucobot.com/oauth/callback
3. Copy Client ID / Secret → Vercel env GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET

GitHub (one-time)

1. Settings → Developer settings → OAuth Apps → New
2. Authorization callback URL: https://oauth.aucobot.com/oauth/callback
3. Copy Client ID / Secret → GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET

AucoBot instance config

OAUTH_MODE=relay
OAUTH_RELAY_URL=https://oauth.aucobot.com
OAUTH_RELAY_API_SECRET=<same as RELAY_API_SECRET on relay>

Provider registry scopes reference Nango providers.yaml (URLs only).

Security

• ALLOWED_RETURN_URL_PREFIXES — comma-separated prefixes for return_url
• RELAY_API_SECRET — Bearer token for POST /api/complete
• Never log token values