Cloudflare OAuth 2.0: an operator grants drupflare access without pasting a long-lived token.
Authorization Code with PKCE (S256) and no client secret, since a secret in an open-source
bundle is published to every deployer. The operator registers a private client for their own
callback. The client id lives in cfw_meta, never on KV_OVERRIDABLE (a KV writer could point
the consent screen at their own app); tests/unit/ops/cf-oauth.spec.ts asserts that.
Cloudflare OAuth 2.0: an operator grants drupflare access without pasting a long-lived token.
Authorization Code with PKCE (S256) and no client secret, since a secret in an open-source bundle is published to every deployer. The operator registers a private client for their own callback. The client id lives in
cfw_meta, never onKV_OVERRIDABLE(a KV writer could point the consent screen at their own app);tests/unit/ops/cf-oauth.spec.tsasserts that.