Implementing redirect server in another language

The authorization code flow is described here: http://unity3dassets.com/wp-content/uploads/2015/10/haptix_wak_oauth_extension.pdf

When a HTTP request is made that requires a new access token, the following occurs:

(1) Register state with your redirect server.

Unity makes a HTTP POST to http://your.redirect.com/oauth-interceptor/register-state endpoint. Headers: Accept=application/json, Content-Type: multipart/form-data. You can view a sample request here. Key 's' is a unique identifier for the state. The state value is used later on to locate your access token, once available. Key 'i' is the Client ID. Key 'k' is your Secret Key. The remainder of the keys are there to assist your redirector with supporting different OAuth implementations. Each OAuth implementation can vary slightly

(2) Unity opens browser to get consent from user.

Example URL for Wunderlist is https://www.wunderlist.com/oauth/authorize?client_id=0660832ed102cb146a33&redirect_uri=http://exist1.haptixgames.com:8080/exist/restxq/oauth-interceptor&state=03e68c85-b7d7-477d-a279-e393ddf83188&scope=&response_type=code.

Note that the state unique identifier is the same that we sent to our redirect server.

(3) Authorization server contacts your redirect server.

Based on the redirect URI you provided in your authorization URL and inside the API's app configuration, the authorization server will issue an HTTP GET to http://your.redirect.com/oauth-interceptor endpoint. Included in this call are error, state, and code query parameters.

(4) Exchange authorization code for access token.

Your redirect server code now has to make an HTTP POST to the API's access token URL. This normally includes sending the authorization code, Client ID, and Secret Key in the POST body. The body is typically includes form fields for each parameter, with a Content-Type header 'application/x-www-form-urlencoded'.

(5) Store the access token.

The response to your code=>token exchange will contain either an error or data which will include the access token. Store this information on the server side for the next step, keying on the state unique identifier.

(6) Return to Unity and retrieve token.

When you navigate back to Unity, gameplay will resume and a HTTP GET request will be made to http://your.redirect.com/oauth-interceptor/retrieve-response?state=03e68c85-b7d7-477d-a279-e393ddf83188. Your server code must then retrieve the token info for the requested state unique identifier and return it in the below format.

{

"r": [

    {

        "k": "access_token",

        "v": "3adff24c2f1aafab9120502e09fc1722937ee3e7df21cbeb5cc6fc181d58"

    }

]

}