Authentication for apps
Your app never handles passwords and never holds a secret. It signs users in through MachineMetrics with a public OAuth client, and when it runs inside MachineMetrics the host supplies the credential for it.
Your OAuth client
Each project has one OAuth client. It identifies the app to MachineMetrics and lists the redirect URIs the app may sign in from. A browser app cannot keep a secret, so the client is public: sign-in uses PKCE and there is no client secret anywhere in your code or config.
mmdev manages clients for you:
| Command | Purpose |
|---|---|
mmdev oauth dev-init | Create the development client, bound to http://development.machinemetrics.com:3000 |
mmdev oauth add --name "My App" --redirect "https://myapp.example.com/authorize/mm/callback" | Create a client for a deployed app |
mmdev oauth list | Find a client's id |
mmdev oauth update --client-id <id> --name "…" --redirect "…" | Rename a client or replace its redirect list |
The redirect URI is your app's origin plus /authorize/mm/callback. When you deploy to a new
origin, add it to the client's redirect list or sign-in will fail there.
The client's name is what users see when they are asked to authorize your app, so name it the way you would want it read aloud.
Scopes
MMProvider asks for a scope when it signs in. reporting is read access to production data
and is what most apps need. See the REST API reference for the scope each
endpoint requires.
What your users see
The first time a user opens your app, MachineMetrics asks them to authorize it, showing the client's name and what it will be able to read. They approve once. After that the app opens without a prompt.
Inside MachineMetrics
When your app runs on a dashboard, on My Apps, or in the Operator Dashboard, the host that embeds it already knows who the user is. It supplies your app's credential directly, so the user is not asked to sign in again. The authorization prompt appears only when the user has not yet approved your app.
Your code does not change for this. mm-react-tools fills the same credential store whether
the app signed in itself or the host supplied the credential. Read credentials with
useMMAuth or useCredential, never cache them, and
let request attach them for you.
Upgrading from mm-react-tools 4
Version 4 apps held an access token and a client secret. See Migrating v4 → v5 for the code changes.