Build on Kaam360

# 1. Swap the code for tokens
curl -X POST https://kaam360.com/oauth/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d grant_type=authorization_code \
  -d code="$CODE" \
  -d redirect_uri=https://yourapp.example/callback \
  -d code_verifier="$VERIFIER"

# 2. Call the API
curl -H "Authorization: Bearer $ACCESS_TOKEN" "https://kaam360.com/api/v2/tasks?mine=true&openOnly=true"

# 3. Later: a new pair (the old refresh token stops working)
curl -X POST https://kaam360.com/oauth/token -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d grant_type=refresh_token -d refresh_token="$REFRESH_TOKEN"

import crypto from "node:crypto";

// Before sending the person to /oauth/authorize: a new verifier and state every time, kept in the person's session.
const verifier = crypto.randomBytes(32).toString("base64url");
const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");
const state = crypto.randomBytes(16).toString("base64url");
session.oauth = { verifier, state };
const authorizeUrl = "https://kaam360.com/oauth/authorize?" + new URLSearchParams({ response_type: "code", client_id: CLIENT_ID,
  redirect_uri: "https://yourapp.example/callback", scope: "tasks:read", state, code_challenge: challenge, code_challenge_method: "S256" });

// Back at https://yourapp.example/callback?code=...&state=...&iss=...
const back = new URL(req.url, "https://yourapp.example").searchParams;
if (!session.oauth?.state || back.get("state") !== session.oauth.state || back.get("iss") !== "https://kaam360.com") throw new Error("Not the sign-in we started");
const code = back.get("code");
const res = await fetch("https://kaam360.com/oauth/token", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded",
             Authorization: "Basic " + Buffer.from(`${CLIENT_ID}:${CLIENT_SECRET}`).toString("base64") },
  body: new URLSearchParams({ grant_type: "authorization_code", code, code_verifier: session.oauth.verifier,
                              redirect_uri: "https://yourapp.example/callback" }),
});
const { access_token, refresh_token } = await res.json();

const tasks = await fetch("https://kaam360.com/api/v2/tasks?mine=true&openOnly=true", {
  headers: { Authorization: `Bearer ${access_token}` },
});
console.log(tasks.headers.get("X-RateLimit-Remaining"), (await tasks.json()).data);

import base64, hashlib, secrets, requests

# Before sending the person to /oauth/authorize: a new verifier and state every time, kept in the person's session.
verifier = secrets.token_urlsafe(32)
challenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b"=").decode()
session["oauth"] = {"verifier": verifier, "state": secrets.token_urlsafe(16)}

# Back at the callback: refuse an answer to a sign-in this person did not start.
expected = session.get("oauth", {}).get("state")
if not expected or not secrets.compare_digest(request.args.get("state", ""), expected) or request.args.get("iss") != "https://kaam360.com":
    abort(400)
code = request.args["code"]

tokens = requests.post("https://kaam360.com/oauth/token", auth=(CLIENT_ID, CLIENT_SECRET), data={
    "grant_type": "authorization_code", "code": code, "code_verifier": session["oauth"]["verifier"],
    "redirect_uri": "https://yourapp.example/callback",
}).json()

r = requests.get("https://kaam360.com/api/v2/tasks", params={"mine": "true", "openOnly": "true"},
                 headers={"Authorization": "Bearer " + tokens["access_token"]})
if r.status_code == 429:
    print("wait", r.headers["Retry-After"], "seconds")
print(r.json()["data"])

using System.Net.Http.Headers;
using System.Security.Cryptography;
using System.Text;
using System.Net.Http.Json;

// Before sending the person to /oauth/authorize: a new verifier and state every time, kept in the person's session.
var verifier = Base64Url(RandomNumberGenerator.GetBytes(32));
var challenge = Base64Url(SHA256.HashData(Encoding.ASCII.GetBytes(verifier)));
var state = Base64Url(RandomNumberGenerator.GetBytes(16));
session.SetString("oauth_verifier", verifier); session.SetString("oauth_state", state);

// Back at the callback: refuse an answer to a sign-in this person did not start.
var returned = request.Query["state"].ToString();
var expected = session.GetString("oauth_state");
if (string.IsNullOrEmpty(expected) || string.IsNullOrEmpty(returned)
    || !CryptographicOperations.FixedTimeEquals(Encoding.UTF8.GetBytes(returned), Encoding.UTF8.GetBytes(expected)))
    throw new InvalidOperationException("Not the sign-in we started");
session.Remove("oauth_state");
var code = request.Query["code"].ToString();

using var http = new HttpClient { BaseAddress = new Uri("https://kaam360.com") };
http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic",
    Convert.ToBase64String(Encoding.UTF8.GetBytes($"{clientId}:{clientSecret}")));
var answer = await http.PostAsync("/oauth/token", new FormUrlEncodedContent(new Dictionary<string, string>
{
    ["grant_type"] = "authorization_code", ["code"] = code, ["code_verifier"] = session.GetString("oauth_verifier")!,
    ["redirect_uri"] = "https://yourapp.example/callback",
}));
var tokens = await answer.Content.ReadFromJsonAsync<Dictionary<string, object>>();

http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", tokens!["access_token"].ToString());
Console.WriteLine(await http.GetStringAsync("/api/v2/tasks?mine=true&openOnly=true"));

static string Base64Url(byte[] b) => Convert.ToBase64String(b).TrimEnd('=').Replace('+', '-').Replace('/', '_');

import crypto from "node:crypto";

// Use the raw body exactly as it arrived (before any JSON parsing).
function isFromKaam360(secret, timestamp, rawBody, signature) {
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!Number.isFinite(age) || age > 300) return false;          // older than 5 minutes: refuse
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected), b = Buffer.from(signature ?? "");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}
// isFromKaam360(process.env.KAAM360_SECRET, req.headers["x-kaam360-timestamp"], rawBody, req.headers["x-kaam360-signature"])

import hashlib, hmac, time

def is_from_kaam360(secret: str, timestamp: str, raw_body: bytes, signature: str) -> bool:
    try:
        if abs(time.time() - int(timestamp)) > 300:   # older than 5 minutes: refuse
            return False
    except (TypeError, ValueError):
        return False
    expected = "sha256=" + hmac.new(secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature or "")

using System.Security.Cryptography;
using System.Text;

static bool IsFromKaam360(string secret, string timestamp, string rawBody, string signature)
{
    if (!long.TryParse(timestamp, out var seconds) || Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - seconds) > 300) return false;
    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
    var expected = "sha256=" + Convert.ToHexString(hmac.ComputeHash(Encoding.UTF8.GetBytes(timestamp + "." + rawBody))).ToLowerInvariant();
    return CryptographicOperations.FixedTimeEquals(Encoding.UTF8.GetBytes(expected), Encoding.UTF8.GetBytes(signature ?? ""));
}