Sign in with ReMeet (OAuth)

When your server needs to act for a person — read their meetings, create one — it asks for access with OAuth 2.0 (authorization code + PKCE S256). The person sees a ReMeet consent window with the list of what your app will be able to do and presses Allow. They can revoke access any time in Settings → Connected apps.

Do you need it?

An app without a server doesn't. To know who opened your app inside a meeting, the context token is enough. OAuth is for calling the REST API on the person's behalf.

Get keys

In your developer account: your app → API and webhooks → Create keys. You get a client_id and a client_secret. The secret is shown once; keep it on your server only. Lost it — press New client secret (the old one stops working at once).

Add the redirect addresses of your server (https; http://localhost is allowed for development).

Scopes

Scope	What the person sees
profile	See your name, language and time zone
email	See your email address
meetings.read	See your meetings: titles, times and links
meetings.write	Create meetings for you

Without scope, you get profile. Ask only for what you use.

The flow from your site

1. Send the person to the authorization address:

   https://remeet.video/oauth/authorize
     ?client_id=YOUR_CLIENT_ID
     &redirect_uri=https://your-site.example/oauth/callback
     &response_type=code
     &scope=profile meetings.read
     &state=RANDOM_STRING
     &code_challenge=BASE64URL(SHA256(code_verifier))
     &code_challenge_method=S256

2. After Allow, ReMeet returns them to redirect_uri?code=…&state=…. Check that state is yours.

3. Your server exchanges the code for tokens:

   curl -X POST https://remeet.video/oauth/token \
     -d grant_type=authorization_code \
     -d client_id=YOUR_CLIENT_ID \
     -d client_secret=YOUR_CLIENT_SECRET \
     -d redirect_uri=https://your-site.example/oauth/callback \
     -d code=CODE_FROM_STEP_2 \
     -d code_verifier=THE_ORIGINAL_VERIFIER

   { "token_type": "Bearer", "expires_in": 3600, "access_token": "eyJ…", "refresh_token": "def5…" }

4. Call the REST API with Authorization: Bearer <access_token>.

The access token lives 1 hour, the refresh token 30 days. Refresh:

curl -X POST https://remeet.video/oauth/token \
  -d grant_type=refresh_token -d refresh_token=… \
  -d client_id=… -d client_secret=… -d scope="profile meetings.read"

If the person already allowed the same scopes, ReMeet doesn't ask again and returns the code at once.

The flow from inside a meeting: app.authorize()

In a meeting your app can ask for access without leaving the call — like Zoom and Discord. ReMeet opens the consent window over the meeting and gives the code back to your frame:

const app = await ReMeet.ready();

document.getElementById('connect').onclick = async () => {
  const verifier = randomString(64);                 // keep it for your server
  const challenge = await sha256base64url(verifier);

  try {
    const { code, redirect_uri } = await app.authorize({
      scopes: ['profile', 'meetings.read'],
      codeChallenge: challenge,
    });
    // Your server exchanges the code: grant_type=authorization_code, redirect_uri, code_verifier, client_secret.
    await fetch('https://api.your-site.example/remeet/connect', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ code, redirect_uri, verifier, contextToken: app.contextToken }),
    });
  } catch (error) {
    if (error.code === 401) app.notify('Without access the app works in a simple mode');
  }
};

• Call authorize() right after a click in your app, or the browser blocks the window (error 409).
• redirect_uri is always https://remeet.video/oauth/sdk-callback — it is allowed for every app automatically; pass it to the token exchange as is.
• Errors: 401 — the person did not allow; 410 — closed the window; 404 — the app has no keys yet.
• In the simulator, authorize() returns a fake code without a window.

Server metadata

Standard OAuth metadata (RFC 8414) for libraries that configure themselves: remeet.video/.well-known/oauth-authorization-server.

Who can sign in

A published app — anyone. An app in testing — only you and its testers; for others the authorization address answers «not found».