Shelly Cloud OAuth (authorization-code) flow — the "connect your account" path that replaces auth keys entirely.
Note: the flow is Shelly's own non-standard variant — there is no
state parameter for CSRF binding, and the authorization code is
itself a JWT whose (unverified) claims name the account's cloud
server. Server claims are pinned to https://*.shelly.cloud before
use.
Flow:
- Send the user to
authorize_url/2(their popup shows Shelly's own login). - Shelly redirects to your
redirect_uriwith acodeparam. exchange_code/2swaps it for a long-lived access token (invalidated only by a password change).
The token authorizes the account API (Shelly.Account) as an
Authorization: Bearer header and the real-time websocket
(Shelly.Events).
The default shelly-diy client id is for personal/DIY integrations;
commercial integrators get their own via Shelly support
(support@shelly.cloud).
Summary
Functions
URL to open (usually in a popup) to start the grant.
Exchange an authorization code for an access token.
Read a JWT's payload without verification (routing only — do not trust).
Convert an exchange_code/2 result into the account map that
Shelly.Account and Shelly.Events take.
Functions
URL to open (usually in a popup) to start the grant.
Exchange an authorization code for an access token.
Returns {:ok, %{access_token: token, user_api_url: url, label: label}} —
user_api_url is the account's home cloud server (read from the
token's JWT claims), label a best-effort account identifier.
Read a JWT's payload without verification (routing only — do not trust).
Convert an exchange_code/2 result into the account map that
Shelly.Account and Shelly.Events take.