Implementing OAuth in a Photoshop plugin requires three distinct components: the Photoshop plugin itself, a server (e.g., a local Node.js server), and the service provider's OAuth endpoints (e.g., Dropbox API).
Because plugins cannot directly handle the OAuth redirect callback in a secure way, the workflow follows this pattern:
- Session Initialization: The plugin requests a session ID from your server.
- Browser Redirection: The plugin opens the user's default browser to a URL on your server.
- OAuth Handshake: Your server manages the full OAuth code grant workflow with the service provider.
- Token Storage: Once the user grants permission, the server saves the access token paired with the session ID.
- Polling: The plugin polls your server to check if the access token is ready for that specific session ID.
- API Access: Once the server provides the token, the plugin uses it to make authenticated calls to the service API.