Using per-login Clef logout hooks

per_login_logout_hooks.md

Using per-login Clef logout hooks

Previously, to use the Clef logout hook, you had to set a single logout hook on your Clef application. This logout hook would be hit every time a user logged out of your app.

With the new per-login Clef logout hooks, you can pass a URL to be hit as the logout hook every time a user logs in.

Passing the logout hook

Using this version of the logout hook is very easy. When you do the /authorize portion of the OAuth handshake, just specify the URL to be hit for logout.

In PHP this would look like this:

<?php

$app_id='562306be5c59cc3f2da25095c05da670';
$app_secret='9fd4e0d1e240e6f95b20a6223c3edbfc';

$code = $_GET["code"];

$postdata = http_build_query(
    array(
        'code' => $code,
        'app_id' => $app_id,
        'app_secret' => $app_secret,
        'logout_hook' => 'http://example.com/your/logout/hook'
    )
);

$opts = array('http' =>
    array(
        'method'  => 'POST',
        'header'  => 'Content-type: application/x-www-form-urlencoded',
        'content' => $postdata
    )
);

$url = 'https://clef.io/api/v1/authorize';

$context  = stream_context_create($opts);
$response = file_get_contents($url, false, $context);

if($response != false &amp;&amp; response['success']):
    $response = json_decode($response);
    $access_token = $response->{'access_token'};
else:
    echo $response['error'];

?>

Same domain policy

The logout_hook must be on the same Application Domain as your Clef application. This Application Domain can be a wildcard domain, following the Google URL match pattern standard (but limited to http and https and the path does not matter). For instance, the following Application Domain settings are valid:

• http://example.com
  • ✓ example.com
  • x subdomain.example.com
  • x sub.subdomain.example.com
• http://*.example.com
  • x example.com
  • ✓ subdomain.example.com
  • ✓ sub.subdomain.example.com
• http://example.com, http//*.example.com
  • ✓ example.com
  • ✓ subdomain.example.com
  • ✓ sub.subdomain.example.com

If the logout_hook does not match the Application Domain a 400 error will be returned on /authorize. The OAuth code is not consumed in this error case, so the request can be retried.

thanks! will get working on this today.