How to Capture OAuth Callbacks in CLI and Desktop Apps with Localhost Servers | HackerNoon

"When building CLI tools or desktop applications that integrate with OAuth providers, you face a unique challenge: how do you capture the authorization code when there's no public-facing server to receive the callback? The answer lies in a clever technique that's been right under our noses - spinning up a temporary localhost server to catch the OAuth redirect. This tutorial walks through building a production-ready OAuth callback server that works across Node.js, Deno, and Bun."

"For web applications, this redirect goes to a public URL. But for CLI tools and desktop apps, we use a localhost UR - typically http://localhost:3000/callback. The OAuth provider redirects to this local address, and our temporary server captures the authorization code from the query parameters. This approach is explicitly blessed by OAuth 2.0 for Native Apps (RFC 8252) and is used by major tools like the GitHub CLI and Google's OAuth libraries."

CLI tools and desktop applications capture OAuth authorization codes by running a temporary localhost HTTP server that receives the provider's redirect to a local callback URL (for example http://localhost:3000/callback). OAuth 2.0 for Native Apps (RFC 8252) endorses this pattern and major tools like the GitHub CLI and Google's libraries use it. Implementations should abstract runtime differences (Node.js, Deno, Bun) behind a common CallbackServer interface with start, waitForCallback, and stop methods. Production-ready servers must handle query parsing, timeouts, runtime detection, and edge cases that commonly break simple implementations.

Read at Hackernoon