Provider authentication

Provider authentication is declared in the provider manifest’s auths[] array. Each entry tells Bricoop which credential or flow to use, how to label it in the UI, and whether it is enabled. Bricoop never sends credentials to a third party and never stores them outside the user’s device; the auths[] entries only describe how Bricoop obtains the credential locally.

Authentication methods

The method field on each auths[] entry selects the authentication strategy. An api_key method asks the user to paste a key, an oauth method runs an authorization-code flow against the provider, and a device_code method shows a code the user enters at the provider’s device-approval page. Each entry carries a name, the method, and an enabled flag; a provider can declare multiple methods and let the user pick the one that fits their account.

Secrets stay local

Credentials and tokens are stored on the user’s device in the local credential store Bricoop Desktop manages. They are never logged in plain text, never synced to a cloud account, and never sent to any endpoint other than the provider that issued them. Bricoop is a local connection layer, not a cloud relay; requests go directly from the user’s device to the provider.

Errors and refresh

Expired or invalid credentials surface as an explicit error in Bricoop Desktop, with the provider and method named so the user knows which entry to fix. Token refresh follows the provider’s published token policy; when a refresh fails or the provider revokes the token, Bricoop stops routing requests and asks the user to re-authenticate. The user can always revoke a credential from Bricoop Desktop, which removes it from the local store immediately.