Developer information

This page contains information for apps that use FISH HWB as their developer site. The website is hosted on GitHub Pages. Private API credentials and token exchanges should stay outside the public site.

Current callback

/auth/tiktok/ is the TikTok OAuth return page used by CubeZ. TikTok can redirect the browser here with an authorisation code; the page displays it locally so CubeZ can finish the exchange itself.

Adding another service

New integrations can use their own path, such as /auth/youtube/, /auth/discord/ or /auth/bluesky/. Keep each callback specific to its service. Add the exact redirect URI to that service's developer settings. Never put client secrets, access tokens or refresh tokens in this repository.

GitHub Pages limits

• GitHub Pages can serve public HTML, CSS, JavaScript, images and static OAuth return pages.
• GitHub Pages should not hold private OAuth client secrets or perform secret-backed token exchanges.
• If an integration needs a server, keep that server separate from this site. Do not hide secrets in browser JavaScript.

CubeZ

CubeZ is a desktop app. This site provides its public callback pages and integration information. The TikTok callback is available at /auth/tiktok/.