Create a Nookara app

A registered app is how your project or website signs people in. You set its name, logo, permissions and web addresses once, and everything after that uses its ID.

1. Create the app

1. Go to My Account > Apps and press Create app.
2. Give it a name and say what it does. After saving you can add a logo.
3. Add its authorized URLs: the sites it runs on, like https://studio.penguinmod.com or https://mygame.example.com. https://*.example.com covers one level of subdomains. Use http://localhost for a program on someone's own computer.
4. Choose its scopes. Some are one choice with levels: View Credits or Transfer Credits (transferring includes viewing), and Manage Files as read only or read and write.

2. Put its ID in your project

In PenguinMod or TurboWarp, use the Nookara block in place of the old one with the permissions box:

Old projects using the previous block keep working until December 3rd. Add the sites your project runs on as authorized URLs: a project only signs in from those.

On a website with the Nookara Embed: <script src="https://nookara.cc/embed.js" data-app="app_..."></script>.

3. In development, then verified

A new app is in development: only you and up to 5 people you add as testers can sign in with it, its permissions start switched off except the basic profile, and the sign-in screen marks it as unverified. When it's ready, press Submit for verification. Once staff accept it, anyone can use it, all its permissions start switched on, and it stops being marked. People can still turn any of them off.

After that, changes to the name, logo, scopes or URLs wait for review while the approved version stays live. The description and website change straight away.

Where tokens work

A token made through your app is only accepted from your authorized URLs, over HTTP and WebSocket. Browsers set the Origin header that this checks, so another website can't use your token. A program outside a browser can send any header it likes, so this doesn't replace keeping tokens private.

Files and media

• Store Data is your app's own keys and values (below). It can't reach anything else on the account.
• Upload Media puts what your app uploads in a folder named after it, and anyone with the link can see those files. Your app can list and delete only what it uploaded itself.
• Manage Files sees (read only) or manages (read and write) all the person's files. Ask for it only if that's what your app is for.

Your app's storage

The storage API gives each app its own folders on each person's account. Whatever storage ID your app uses, it stays yours: other apps, legacy projects and the person's website session can't change what your app saved there. The person can see it on their account, and clear it if your app is ever deleted.

Upgrading from a legacy login: values your project saved before aren't in the new folders. They stay on the old storage ID, which an app's token can't read, so plan for players starting those values again.

Without the extension: the flow

1. POST /auth/ext-code with {"app_id":"app_..."} from your page. The answer is {"code":"..."}. A page whose address isn't authorized gets 403 origin_not_authorized.
2. Open https://nookara.cc/login?code=CODE with window.open from that page, and listen for a message from https://nookara.cc with type: "nookara_app_grant", carrying code and grant.
3. POST /auth/ext-code/exchange with {"code":"...","grant":"..."}. The answer is {"token":"...","app_id":"...","scopes":N}. A grant works once.

GET /auth/ext-code/status never gives an app's token. It only says {"ready":false,"approved":true,"alive":true}, so you can notice the window being closed.

Programs on someone's computer, and full-page sign-in

Send redirect_uri in the first step, on one of your authorized URLs. For a program, authorize http://localhost (any port) and listen on a local port. After approving, the browser goes to redirect_uri#nookara_code=CODE&nookara_grant=GRANT. The Python library does this for you:

from velora_api import Client, login_app

token, origin = login_app("app_...")
api = Client(token, origin=origin)

Errors