OAuth 接入指南

https://maimai.lxns.net/oauth/authorize?response_type=code&client_id=[应用 ID]&redirect_uri=[回调地址]&scope=[应用权限]

https://maimai.lxns.net/oauth/authorize?response_type=code&client_id=[应用 ID]&redirect_uri=[回调地址]&scope=read_player&state=[随机值]

https://maimai.lxns.net/oauth/authorize?response_type=code&client_id=[应用 ID]&redirect_uri=[回调地址]&scope=openid%20profile%20email&state=[随机值]&nonce=[随机值]

POST /api/v0/oauth/token

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 900,
  "refresh_token": "SjiF1mnYY0qa1PEJhjeyDQPGPcBjWOKu",
  "scope": "openid profile email",
  "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6Im1haW1haS1wcm9iZXItb2lkYy0xIn0..."
}

{
  "error": "invalid_grant",
  "error_description": "authorization code expired"
}

GET /api/v0/user/maimai/player

POST /api/v0/oauth/token

{
  "client_id": "e07f2ae3-795b-4368-b55f-5f27b0b3eae0",
  "client_secret": "fUluk5OJQ6OF8PGqGxs3TJ2zdZpwgDTs",
  "grant_type": "refresh_token",
  "refresh_token": "SjiF1mnYY0qa1PEJhjeyDQPGPcBjWOKu"
}

GET https://maimai.lxns.net/.well-known/openid-configuration

GET https://maimai.lxns.net/.well-known/oauth-authorization-server

GET https://maimai.lxns.net/api/v0/oauth/userinfo
Authorization: Bearer [access_token]

{
  "sub": "12345",
  "name": "example-user",
  "preferred_username": "example-user",
  "email": "user@example.com",
  "email_verified": true
}

{
  "client_id": "e07f2ae3-795b-4368-b55f-5f27b0b3eae0",
  "client_secret": "fUluk5OJQ6OF8PGqGxs3TJ2zdZpwgDTs",
  "grant_type": "authorization_code",
  "code": "Oze6RZ0nPKy4JSmpI2aYxEIUmhl0l5fU",
  "redirect_uri": "http://localhost:5000/callback"
}

from flask import Flask, request, session
import requests
import urllib.parse
import secrets
import os

app = Flask(__name__)
# 使用 secrets.token_hex(32) 生成后写入环境变量
app.secret_key = os.environ["FLASK_SECRET_KEY"]

# 应用信息
CLIENT_ID = "e07f2ae3-795b-4368-b55f-5f27b0b3eae0"
CLIENT_SECRET = "fUluk5OJQ6OF8PGqGxs3TJ2zdZpwgDTs"
REDIRECT_URI = "http://localhost:5000/callback"

# OAuth 接口地址
AUTHORIZE_URL = "https://maimai.lxns.net/oauth/authorize"
TOKEN_URL = "https://maimai.lxns.net/api/v0/oauth/token"
PLAYER_API_URL = "https://maimai.lxns.net/api/v0/user/maimai/player"

@app.route("/")
def home():
    scope = ["read_player"]
    state = secrets.token_urlsafe(16)
    session["oauth_state"] = state
    query = {
        "response_type": "code",
        "client_id": CLIENT_ID,
        "redirect_uri": REDIRECT_URI,
        "scope": " ".join(scope),
        "state": state
    }
    url = f"{AUTHORIZE_URL}?{urllib.parse.urlencode(query)}"
    return f'<a href="{url}">点击授权</a>'

@app.route("/callback")
def callback():
    code = request.args.get("code")
    if not code:
        return "授权失败，未获取到授权码", 400
    if request.args.get("state") != session.pop("oauth_state", None):
        return "授权失败，state 校验未通过", 400

    # 获取访问码
    resp = requests.post(TOKEN_URL, data={
        "grant_type": "authorization_code",
        "code": code,
        "client_id": CLIENT_ID,
        "client_secret": CLIENT_SECRET,
        "redirect_uri": REDIRECT_URI
    })
    token = resp.json()["access_token"]

    # 调用 API
    player = requests.get(PLAYER_API_URL, headers={
        "Authorization": f"Bearer {token}"
    }).json()

    return player

if __name__ == "__main__":
    app.run()

{
  "client_id": "e07f2ae3-795b-4368-b55f-5f27b0b3eae0",
  "grant_type": "authorization_code",
  "code": "Oze6RZ0nPKy4JSmpI2aYxEIUmhl0l5fU",
  "redirect_uri": "http://localhost:5000/callback",
  "code_verifier": "randomly_generated_code_verifier"
}

from flask import Flask, request, session
import requests
import urllib.parse
import secrets
import hashlib
import base64
import os

app = Flask(__name__)
# 使用 secrets.token_hex(32) 生成后写入环境变量
app.secret_key = os.environ["FLASK_SECRET_KEY"]

# 应用信息（公共客户端，无 secret）
CLIENT_ID = "e07f2ae3-795b-4368-b55f-5f27b0b3eae0"
REDIRECT_URI = "http://localhost:5000/callback"

# OAuth 接口地址
AUTHORIZE_URL = "https://maimai.lxns.net/oauth/authorize"
TOKEN_URL = "https://maimai.lxns.net/api/v0/oauth/token"
PLAYER_API_URL = "https://maimai.lxns.net/api/v0/user/maimai/player"

# 生成 code_verifier 和 code_challenge
def generate_code_verifier():
    return secrets.token_urlsafe(64)

def generate_code_challenge(verifier):
    digest = hashlib.sha256(verifier.encode()).digest()
    return base64.urlsafe_b64encode(digest).rstrip(b'=').decode()

@app.route("/")
def home():
    scope = ["read_player"]

    # 生成随机 code_verifier
    code_verifier = generate_code_verifier()
    code_challenge = generate_code_challenge(code_verifier)
    state = secrets.token_urlsafe(16)
    session["oauth_state"] = state
    session["code_verifier"] = code_verifier

    query = {
        "response_type": "code",
        "client_id": CLIENT_ID,
        "redirect_uri": REDIRECT_URI,
        "scope": " ".join(scope),
        "code_challenge": code_challenge,
        "code_challenge_method": "S256",
        "state": state
    }
    url = f"{AUTHORIZE_URL}?{urllib.parse.urlencode(query)}"
    return f'<a href="{url}">点击授权</a>'

@app.route("/callback")
def callback():
    code = request.args.get("code")
    if not code:
        return "授权失败，未获取到授权码", 400
    if request.args.get("state") != session.pop("oauth_state", None):
        return "授权失败，state 校验未通过", 400
    code_verifier = session.pop("code_verifier", None)
    if not code_verifier:
        return "授权失败，code_verifier 不存在", 400

    # 用 code_verifier 换 token
    resp = requests.post(TOKEN_URL, data={
        "grant_type": "authorization_code",
        "code": code,
        "client_id": CLIENT_ID,
        "redirect_uri": REDIRECT_URI,
        "code_verifier": code_verifier
    })
    token_data = resp.json()
    access_token = token_data["access_token"]

    # 调用 API
    player = requests.get(PLAYER_API_URL, headers={
        "Authorization": f"Bearer {access_token}"
    }).json()

    return player

if __name__ == "__main__":
    app.run()