Decisions you can inspect.

Short-lived challenges

Challenge URLs contain a random, single-use token. The database stores only a digest. The challenge binds your account UUID to the requesting integration and network context. After validating the OAuth state, the API reserves the challenge before exchanging the provider code, preventing concurrent callbacks from reusing it.

Your backend must verify ownership of the submitted account ID. Anyone holding a challenge URL can attempt to link the account it represents, so deliver that URL only to the user who started the request.

Discord OAuth

The production flow requests the identify scope, validates the OAuth state server-side, uses the configured exact redirect URI, and fetches the Discord profile only after code exchange. OAuth access tokens are not persisted for basic linking.

Integration credentials

Each integration has its own credential. plexsur.net stores a digest and displays the secret only at creation or rotation. Credentials stay on your backend and are scoped to their integration and workspace.

A successful browser result page is informational. Check the authorize endpoint from your backend before granting access or creating an application session.

Outage behavior

Integrations honor the configured failure mode. In fail-closed mode, unknown players remain blocked while recently verified cache entries can be accepted according to the server configuration. In fail-open mode, the owner accepts the security tradeoff explicitly.