# Spotless.run

Instant OAuth access to services without registering apps.
Spotless handles authorization via pre registered apps and hands back a token for use directly with the service API.
{#Get-started}
## Get started

{#Device-Login}
### Device Login

Use for browserless clients i.e. SSH sessions, CI and agents, even if the service does not support browserless login.
1. Start the device flow for a service, i.e. dnsimple.
```bash
curl -s -X POST https://spotless.run/device/dnsimple \
  --data-urlencode 'client_id=http://localhost'
```

2. Open the [verification URL](https://spotless.run/verify) in any browser and enter the `user_code`.

3. Poll the token endpoint with the `device_code`
```bash
curl -s -X POST https://spotless.run/token \
  --data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:device_code' \
  --data-urlencode 'client_id=http://localhost' \
  --data-urlencode 'device_code=THE_DEVICE_CODE'
```
You don't need to use bash.
Full specification in [RFC 8628](https://www.rfc-editor.org/rfc/rfc8628.txt)
{#Browser-Login}
### Browser Login

Use for web apps running on localhost.
1. `GET /authorize/{service}`: start the authorization code flow.
- Your `client_id` must be a localhost origin, `http://localhost:1234`.

- The `redirect_uri` origin must be the same as your `client_id`.

2. Handle the redirect to your app on localhost.

3. `POST /token`: exchange the spotless code for the service access token.
Full specification in [OAuth v2.1](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1)
{#Who-is-it-for}
## Who is it for

- Code first integrations, replace clunky tools like Zapier and n8n with powerful scripts.
- Agents that need quick access to your email, code or infra.
{#Is-it-secure}
## Is it secure

- Spotless never stores a token, stores only mininal information to manage authorization.
- Spotless does not see your API calls, you make them direct with real API tokens.
- Spotless follows the OAuth 2.1 standard and smooths out inconsistencies in upstream implementations.
It's probably better than pasting API tokens into company chat.
{#Why-now}
## Why now

Agents are only valuable when they can safely use real tools.
The slow part is not writing the script; it is OAuth  app setup, browserless login etc.
Spotless pays that integration cost once spotless is free to use for local development for services that allow free integrations.
## Spotless.run

- [Device Login](/guides/device-login.md)
- [Device Login with Bash](/guides/device-login-with-bash.md)